CSPM Security Incident Response & Management

Question 1

According to NIST SP 800-61, what is the correct order of the incident response lifecycle phases?

Accepted Answer

Preparation, Detection & Analysis, Containment/Eradication/Recovery, Post-Incident Activity

Answer

NIST SP 800-61 defines four phases: Preparation; Detection & Analysis; Containment, Eradication & Recovery; and Post-Incident Activity.

Question 2

What document formally defines the scope, authority, and responsibilities of an incident response team?

Accepted Answer

Incident Response Plan

Answer

The Incident Response Plan (IRP) formally defines the team's scope, authority, communication procedures, and step-by-step response procedures.

Question 3

A security project manager discovers a breach mid-project. What should be the FIRST action taken?

Accepted Answer

Activate the incident response plan

Answer

Activating the incident response plan ensures a structured, coordinated approach to handling the breach from the outset.

Question 4

What is the primary purpose of 'containment' during incident response?

Accepted Answer

To limit the damage and prevent the incident from spreading

Answer

Containment's primary goal is to stop further damage by limiting the incident's spread while preserving evidence for analysis.

Question 5

What does 'chain of custody' ensure in a security incident investigation?

Accepted Answer

That evidence is properly collected, documented, and protected from tampering

Answer

Chain of custody documents who handled evidence, when, and how, ensuring its integrity and admissibility in legal proceedings.

(CSPM) Certified Security Project Manager Practice Test