ISAC Incident Response and Reporting

Question 1

What is the first step in an organization's incident response process?

Accepted Answer

Identification and detection of the incident

Answer

Eradication of the threat

Answer

Recovery of affected systems

Answer

Documentation of the incident

Question 2

Which of the following best describes an incident response plan?

Accepted Answer

A step-by-step process for detecting, responding to, and recovering from security incidents

Answer

A set of guidelines for daily IT operations

Answer

A checklist of required hardware for disaster recovery

Answer

A software tool used to automate system monitoring

Question 3

What is the purpose of conducting a post-incident analysis?

Accepted Answer

To identify lessons learned and improve future responses

Answer

To determine how to punish the attackers

Answer

To test the organization's antivirus software

Answer

To back up affected systems

Question 4

What should be done immediately after a security breach is confirmed?

Accepted Answer

Contain the breach to limit further damage

Answer

Alert law enforcement authorities

Answer

Shut down all affected systems without investigation

Answer

Notify the media to maintain transparency

Question 5

Why is timely reporting of a security incident important?

Accepted Answer

To comply with industry regulations and notify affected stakeholders

Answer

To ensure the organization avoids legal penalties

Answer

To shift blame to another department

Answer

To avoid further attacks from the same threat actor