CSPM Security Incident Response & Management 2

Question 1

What is the distinction between a security 'event' and a security 'incident'?

Accepted Answer

An event is any observable occurrence; an incident is an event that negatively impacts security

Answer

Events are external threats while incidents are internal threats

Answer

Events are logged automatically while incidents require manual detection

Answer

An incident is a potential threat while an event is a confirmed breach

Question 2

During which incident response phase is forensic evidence collected and analyzed?

Accepted Answer

Detection & Analysis

Answer

Preparation

Answer

Containment

Answer

Post-Incident Activity

Question 3

What is the purpose of an Incident Response Retainer with an external security firm?

Accepted Answer

To ensure pre-negotiated access to specialized IR expertise when an incident occurs

Answer

To outsource all security operations to a third party permanently

Answer

To comply with regulatory requirements for third-party security audits

Answer

To provide 24/7 monitoring of the organization's network

Question 4

During the eradication phase of incident response, what is the primary goal?

Accepted Answer

Removing all traces of the threat from the environment

Answer

Preventing the incident from affecting additional systems

Answer

Restoring systems to their pre-incident state

Answer

Notifying affected customers and stakeholders

Question 5

Which metric measures the average time between when an incident is detected and when it is fully contained?

Accepted Answer

Mean Time to Contain (MTTC)

Answer

Mean Time to Detect (MTTD)

Answer

Mean Time to Respond (MTTR)

Answer

Recovery Time Objective (RTO)

Question 6

What is a tabletop exercise in the context of incident response?

Accepted Answer

A discussion-based exercise where participants walk through a hypothetical incident scenario

Answer

A physical simulation where responders practice isolating infected machines

Answer

An automated red team attack on production systems

Answer

A post-incident review meeting focused on metrics and KPIs

Question 7

Which role is typically responsible for declaring a security incident and initiating the formal response process in a large organization?

Accepted Answer

Incident Response Manager or CISO

Answer

Network Administrator

Answer

Security Analyst

Answer

Help Desk Technician