CSL Incident Response & Crisis Management 3

Question 1

After a major incident, a post-mortem reveals the IR plan failed because teams were unfamiliar with their roles. What is the BEST long-term corrective action?

Accepted Answer

Implement mandatory recurring IR drills and role-specific training tied to the IR plan

Answer

Regular drills and role-specific training build muscle memory, ensuring team members can execute their responsibilities under pressure during real incidents.

Question 2

During incident containment, an analyst recommends isolating an entire business-critical server. What leadership consideration is MOST important?

Accepted Answer

The business impact of isolation versus the risk of continued attacker access

Answer

Leaders must weigh operational disruption against the risk that continued attacker presence causes greater harm, making business impact analysis central to the decision.

Question 3

A threat intelligence feed reports an IOC (Indicator of Compromise) matching traffic in your environment. What is the FIRST step in the IR process?

Accepted Answer

Validate the IOC against internal logs to confirm whether a real incident exists

Answer

Validating the IOC against internal telemetry confirms whether the indicator represents an active threat or a false positive before taking disruptive action.

Question 4

Under GDPR, within how many hours must a personal data breach be reported to the relevant supervisory authority after the organization becomes aware of it?

Accepted Answer

72 hours

Answer

GDPR Article 33 mandates notification to the supervisory authority within 72 hours of becoming aware of a personal data breach, where feasible.

Question 5

Which type of incident response retainer provides the MOST value for an organization that lacks an internal IR team?

Accepted Answer

A proactive retainer that includes pre-engagement scoping, access, and readiness assessments

Answer

A proactive retainer ensures the IR firm has pre-established access, network knowledge, and tooling deployed before an incident occurs, dramatically reducing response time.

(CSL) Cybersecurity Leadership Certification Practice Test

(CSL) Cybersecurity Leadership Certification Practice Test

CSL Incident Response & Crisis Management 3