CJIS Incident Response & System Auditing

Question 1

What is the first step in incident response?

Accepted Answer

Identify and report

Answer

Ignore incident

Answer

Delete evidence

Answer

Delay response

Question 2

Why is an incident response plan important?

Accepted Answer

Structured breach response

Answer

No plan needed

Answer

Confuses teams

Answer

Avoids reporting

Question 3

What is system auditing used for?

Accepted Answer

Review activity

Answer

Hide activity

Answer

Ignore logs

Answer

Speed systems

Question 4

How often should audits be conducted?

Accepted Answer

Regularly

Answer

Once only

Answer

Never

Answer

Only after incidents

Question 5

What is a key component of incident documentation?

Accepted Answer

Detailed records

Answer

Minimal notes

Answer

No documentation

Answer

Ignore incidents

Question 6

Who should be notified in a major security incident?

Accepted Answer

Notify authorities

Answer

Ignore notification

Answer

Tell media first

Answer

Avoid communication

Question 7

Why is root cause analysis important?

Accepted Answer

Find root cause

Answer

Ignore causes

Answer

Blame users

Answer

Delay fixes

Question 8

What is the role of log review in auditing?

Accepted Answer

Detect suspicious activity

Answer

Ignore logs

Answer

Delete logs

Answer

Speed operations

Question 9

How can incident response be improved?

Accepted Answer

Regular drills and updates

Answer

No drills

Answer

Ignore updates

Answer

Delay training