Security Incident Response & Management Flashcards

What does MTTR stand for in incident response metrics?

Answer: Mean Time to Recover

MTTR stands for Mean Time to Recover (or Resolve), measuring the average time from incident detection to full system restoration.

A CSPM must ensure that incident response activities align with the project schedule. Which approach best balances security response with project continuity?

Answer: Continue project work on unaffected systems while the IR team handles the incident in parallel

Isolating affected systems while continuing work on unaffected areas allows the project to maintain momentum while the IR team focuses on containment and resolution.

What is the purpose of an Incident Severity Classification system?

Answer: To prioritize resource allocation and response speed based on business impact

Severity classification (e.g., Critical, High, Medium, Low) helps organizations prioritize their response efforts and allocate appropriate resources based on the incident's potential business impact.

What is 'digital forensics' as applied in a security incident context?

Answer: The scientific collection, preservation, and analysis of digital evidence for investigation

Digital forensics involves the rigorous, scientifically sound collection and analysis of digital evidence to reconstruct events, identify threat actors, and support legal or disciplinary proceedings.

Which communication document is typically sent to stakeholders during a significant security incident to provide status updates?

Answer: Incident Situation Report (SitRep)

A Situation Report (SitRep) provides stakeholders with timely, structured updates on incident status, current actions, and next steps during an active incident.

When should an organization notify regulatory authorities or law enforcement after a security incident?

Answer: According to timelines specified by applicable laws, regulations, and contractual obligations

Notification timelines and requirements are governed by applicable regulations (e.g., GDPR's 72-hour rule, HIPAA, state breach laws) and contracts, which the CSPM must understand and follow.

What is the key benefit of developing and maintaining an Incident Response Playbook?

Answer: It provides step-by-step procedures for common incident types, reducing decision fatigue under pressure

Playbooks pre-define response steps for specific incident types (e.g., ransomware, phishing, DDoS), allowing responders to act quickly and consistently without having to make complex decisions in a stressful moment.