CSPM Security Incident Response & Management 2

Question 1

What is the distinction between a security 'event' and a security 'incident'?

Accepted Answer

An event is any observable occurrence; an incident is an event that negatively impacts security

Answer

A security event is any observable system occurrence, while an incident is specifically an event that threatens or violates security policies, AUPs, or standard security practices.

Question 2

During which incident response phase is forensic evidence collected and analyzed?

Accepted Answer

Detection & Analysis

Answer

The Detection & Analysis phase involves collecting, preserving, and analyzing evidence to understand the nature, scope, and impact of the incident.

Question 3

What is the purpose of an Incident Response Retainer with an external security firm?

Accepted Answer

To ensure pre-negotiated access to specialized IR expertise when an incident occurs

Answer

An IR retainer pre-negotiates terms, pricing, and access with a specialized firm so organizations can quickly engage expert help during a major incident without delays.

Question 4

During the eradication phase of incident response, what is the primary goal?

Accepted Answer

Removing all traces of the threat from the environment

Answer

Eradication focuses on completely removing the threat — including malware, backdoors, and unauthorized accounts — from all affected systems.

Question 5

Which metric measures the average time between when an incident is detected and when it is fully contained?

Accepted Answer

Mean Time to Contain (MTTC)

Answer

Mean Time to Contain (MTTC) specifically measures the time elapsed from detection to successful containment of the threat.

(CSPM) Certified Security Project Manager Practice Test

(CSPM) Certified Security Project Manager Practice Test

CSPM Security Incident Response & Management 2