ISC2 CC Incident Response

Question 1

What is the PRIMARY purpose of an incident response plan?

Accepted Answer

To provide a structured approach for managing security incidents

Answer

To prevent all security incidents from occurring

Answer

To replace the need for security monitoring tools

Answer

To document all system vulnerabilities

Question 2

Which phase of the NIST incident response lifecycle involves identifying whether a security incident has actually occurred?

Accepted Answer

Detection and Analysis

Answer

Containment

Answer

Eradication

Answer

Recovery

Question 3

What does CSIRT stand for in cybersecurity?

Accepted Answer

Computer Security Incident Response Team

Answer

Cyber Security Incident Response Team

Answer

Critical Security Incident Reporting Tool

Answer

Centralized Security Incident Review Team

Question 4

Which of the following BEST describes an Indicator of Compromise (IoC)?

Accepted Answer

A forensic artifact suggesting a system has been breached

Answer

A software patch that fixes a known vulnerability

Answer

A policy defining acceptable use of resources

Answer

A tool used to scan networks for open ports

Question 5

During which incident response phase would you isolate an affected system from the network?

Accepted Answer

Containment

Answer

Preparation

Answer

Detection and Analysis

Answer

Post-Incident Activity

Question 6

What is the FIRST phase of the NIST SP 800-61 incident response lifecycle?

Accepted Answer

Preparation

Answer

Detection and Analysis

Answer

Containment, Eradication, and Recovery

Answer

Post-Incident Activity

Question 7

Which document outlines the specific roles, responsibilities, and procedures for responding to security incidents?

Accepted Answer

Incident Response Plan

Answer

Security Policy

Answer

Business Impact Analysis

Answer

Risk Assessment Report