CSPM Security Incident Response & Management

Question 1

According to NIST SP 800-61, what is the correct order of the incident response lifecycle phases?

Accepted Answer

Preparation, Detection & Analysis, Containment/Eradication/Recovery, Post-Incident Activity

Answer

Detection, Containment, Eradication, Recovery, Lessons Learned

Answer

Identification, Protection, Detection, Response, Recovery

Answer

Triage, Investigation, Containment, Remediation, Closure

Question 2

What document formally defines the scope, authority, and responsibilities of an incident response team?

Accepted Answer

Incident Response Plan

Answer

Incident Response Policy

Answer

Security Operations Charter

Answer

Risk Register

Question 3

A security project manager discovers a breach mid-project. What should be the FIRST action taken?

Accepted Answer

Activate the incident response plan

Answer

Notify all project stakeholders immediately

Answer

Preserve evidence and isolate affected systems

Answer

Conduct a root cause analysis

Question 4

What is the primary purpose of 'containment' during incident response?

Accepted Answer

To limit the damage and prevent the incident from spreading

Answer

To permanently remove the attacker's tools from the environment

Answer

To restore affected systems to normal operation

Answer

To identify the root cause of the incident

Question 5

What does 'chain of custody' ensure in a security incident investigation?

Accepted Answer

That evidence is properly collected, documented, and protected from tampering

Answer

That all affected systems are patched in sequential order

Answer

That incident responders follow escalation procedures in order

Answer

That management approves each step before investigators proceed

Question 6

Which incident response team structure consists of security professionals across departments who fulfill IR duties in addition to their normal roles?

Accepted Answer

Virtual Incident Response Team

Answer

Dedicated Security Incident Response Team (SIRT)

Answer

Managed Security Service Provider (MSSP) Model

Answer

Coordinating Incident Response Team

Question 7

What is the primary objective of the 'Post-Incident Activity' phase in NIST's incident response lifecycle?

Accepted Answer

To document lessons learned and improve future response capabilities

Answer

To file legal charges against threat actors

Answer

To restore all affected systems to full operational status

Answer

To notify regulatory bodies of the breach