CSC Incident Response and Reporting 2

Question 1

During the containment phase of incident response, which action should be taken FIRST?

Accepted Answer

Isolate affected systems to prevent lateral movement

Answer

Eradicate all malware from affected systems

Answer

Notify law enforcement about the breach

Answer

Conduct a full forensic investigation

Question 2

Which regulation requires covered entities to report a breach of unsecured protected health information within 60 days of discovery?

Accepted Answer

HIPAA Breach Notification Rule

Answer

PCI DSS

Answer

GDPR

Answer

SOX

Question 3

A 'chain of custody' document in incident response primarily ensures:

Accepted Answer

That evidence integrity is maintained for potential legal proceedings

Answer

That incident costs are tracked for insurance claims

Answer

That all stakeholders are notified in the correct order

Answer

That system backups are created before remediation

Question 4

Under GDPR, what is the maximum timeframe for reporting a personal data breach to the relevant supervisory authority?

Accepted Answer

72 hours

Answer

24 hours

Answer

48 hours

Answer

7 days

Question 5

Which document defines the roles, responsibilities, and communication procedures to follow during a cybersecurity incident?

Accepted Answer

Incident Response Plan (IRP)

Answer

Business Continuity Plan (BCP)

Answer

Disaster Recovery Plan (DRP)

Answer

Vulnerability Management Policy

Question 6

After fully remediating an incident, what is the purpose of conducting a 'lessons learned' session?

Accepted Answer

To identify gaps and improve future incident response capabilities

Answer

To assign blame to responsible individuals

Answer

To document the incident for insurance purposes only

Answer

To satisfy audit requirements without operational value

Question 7

Which NIST CSF function most directly encompasses incident response activities?

Accepted Answer

Respond

Answer

Identify

Answer

Protect

Answer

Recover