CSPM Security Incident Response & Management 3

Question 1

What does MTTR stand for in incident response metrics?

Accepted Answer

Mean Time to Recover

Answer

Maximum Threat Tolerance Rating

Answer

Minimum Time to Remediate

Answer

Mean Threat and Response Ratio

Question 2

A CSPM must ensure that incident response activities align with the project schedule. Which approach best balances security response with project continuity?

Accepted Answer

Continue project work on unaffected systems while the IR team handles the incident in parallel

Answer

Pause all project activities until the incident is fully resolved

Answer

Outsource incident response to avoid disrupting project timelines

Answer

Document the incident and address it during the next project phase

Question 3

What is the purpose of an Incident Severity Classification system?

Accepted Answer

To prioritize resource allocation and response speed based on business impact

Answer

To assign blame to responsible parties after an incident

Answer

To determine which regulatory body must be notified

Answer

To calculate the financial cost of each incident

Question 4

What is 'digital forensics' as applied in a security incident context?

Accepted Answer

The scientific collection, preservation, and analysis of digital evidence for investigation

Answer

The use of automated tools to patch vulnerabilities after an incident

Answer

The process of backing up data before restoring affected systems

Answer

Real-time monitoring of network traffic during an active attack

Question 5

Which communication document is typically sent to stakeholders during a significant security incident to provide status updates?

Accepted Answer

Incident Situation Report (SitRep)

Answer

Incident After-Action Report

Answer

Security Risk Register Update

Answer

Vulnerability Disclosure Notice

Question 6

When should an organization notify regulatory authorities or law enforcement after a security incident?

Accepted Answer

According to timelines specified by applicable laws, regulations, and contractual obligations

Answer

Only after the incident is fully resolved and documented

Answer

Immediately upon detecting any suspicious activity

Answer

Only when the financial damage exceeds a predetermined threshold

Question 7

What is the key benefit of developing and maintaining an Incident Response Playbook?

Accepted Answer

It provides step-by-step procedures for common incident types, reducing decision fatigue under pressure

Answer

It eliminates the need for a dedicated incident response team

Answer

It satisfies all regulatory compliance requirements for incident management

Answer

It replaces the need for tabletop exercises and IR training