ISC2 CC Business Continuity and Disaster Recovery 3

Question 1

What is the primary objective of incident response?

Accepted Answer

Minimizing the impact of security incidents and restoring operations

Answer

Prosecuting attackers

Answer

Documenting all security events for compliance

Answer

Training employees after an incident occurs

Question 2

Which phase of incident response involves identifying what happened and its scope?

Accepted Answer

Detection and Analysis

Answer

Preparation

Answer

Containment

Answer

Recovery

Question 3

What is the purpose of the containment phase in incident response?

Accepted Answer

To stop the spread of the incident and limit further damage

Answer

To identify the root cause of the incident

Answer

To restore affected systems to normal operation

Answer

To notify law enforcement about the incident

Question 4

What is a tabletop exercise in business continuity planning?

Accepted Answer

A discussion-based exercise where participants walk through a hypothetical scenario

Answer

A full simulation of a disaster recovery scenario

Answer

A penetration test of physical security controls

Answer

A technical test of backup restoration procedures

Question 5

Which step comes AFTER eradication in the standard incident response process?

Accepted Answer

Recovery

Answer

Identification

Answer

Containment

Answer

Preparation

Question 6

What is the purpose of an after-action report (AAR) following a security incident?

Accepted Answer

To document what happened, what worked, and what needs improvement

Answer

To bill the cost of incident response to affected departments

Answer

To notify customers about the breach

Answer

To archive all incident logs for legal purposes