CSC Incident Response and Reporting 3

Question 1

An organization discovers that an attacker exfiltrated customer credit card data three weeks ago. Under PCI DSS, which entity must be notified immediately?

Accepted Answer

The acquiring bank and card brands

Answer

PCI DSS requires merchants to notify their acquiring bank (and through them the card brands) immediately upon discovering a cardholder data compromise.

Question 2

What is the primary goal of the 'eradication' phase in the incident response lifecycle?

Accepted Answer

Remove the root cause and all traces of the threat from the environment

Answer

Eradication focuses on eliminating the threat actor's foothold, malware, and any backdoors before systems are restored to production.

Question 3

A security analyst notices unusual outbound traffic at 2 AM. Before escalating, they should first:

Accepted Answer

Verify whether the traffic is part of scheduled maintenance or legitimate business activity

Answer

Verifying context before escalation prevents false positives and ensures the response effort is proportionate to an actual threat.

Question 4

Which type of incident response team model uses internal staff who handle incidents as a secondary duty alongside their primary roles?

Accepted Answer

Virtual CSIRT

Answer

A Virtual CSIRT has no dedicated full-time members; instead, staff from various departments respond to incidents on an on-call basis.

Question 5

Under NY SHIELD Act, businesses must notify affected New York residents of a breach affecting their private information within:

Accepted Answer

As expediently as possible without unreasonable delay

Answer

The NY SHIELD Act requires notification in the most expedient time possible and without unreasonable delay, rather than setting a fixed deadline.

(CSC) Cybersecurity Compliance Certification Practice Test

(CSC) Cybersecurity Compliance Certification Practice Test

CSC Incident Response and Reporting 3