Incident Response Flashcards
7 cards from real ISC2 CC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Incident Response flashcards as text
Which of the following would MOST likely be classified as a high-severity incident requiring immediate escalation?
Answer: Ransomware encryption spreading across critical production servers
Ransomware spreading across critical production servers directly threatens the availability and integrity of critical organizational assets, making it the highest severity.
What is the formal document created to capture all details about a security incident for analysis and compliance purposes?
Answer: Incident Report
An Incident Report is the formal documentation capturing all relevant details about a security incident for analysis, compliance, and future reference.
When collecting digital evidence during incident response, what is MOST critical to ensure?
Answer: Evidence integrity is maintained
Maintaining evidence integrity ensures that digital evidence accurately reflects the state of systems at the time of the incident and is admissible in legal proceedings.
After detecting a data breach, what should happen FIRST according to incident response best practices?
Answer: Contain the incident to limit further damage
Containment should occur first to stop the spread and limit the damage of the breach before notification, investigation, or other activities proceed.
What distinguishes a security 'incident' from a security 'event'?
Answer: An event is any observable occurrence; an incident is an event that threatens or violates security policy
An event is any observable occurrence in a system or network, while an incident is an event that actually violates or imminently threatens the violation of security policies.
Which regulation requires organizations to report personal data breaches to supervisory authorities within 72 hours?
Answer: GDPR (General Data Protection Regulation)
GDPR mandates that organizations notify the relevant supervisory authority of a personal data breach within 72 hours of becoming aware of it.
What is a 'tabletop exercise' in the context of incident response preparedness?
Answer: A discussion-based exercise where participants walk through hypothetical incident scenarios
A tabletop exercise is a discussion-based simulation where team members verbally work through their roles and actions during a hypothetical incident without executing an actual response.