ISC2 CC Incident Response 2

Question 1

What is the goal of the Eradication phase in incident response?

Accepted Answer

Removing the root cause and malicious artifacts from affected systems

Answer

Documenting lessons learned from the incident

Answer

Restoring systems to normal operations

Answer

Notifying management of the incident

Question 2

'Lessons learned' activities primarily occur during which phase of the incident response lifecycle?

Accepted Answer

Post-Incident Activity

Answer

Preparation

Answer

Containment

Answer

Recovery

Question 3

Which of the following BEST represents a security incident?

Accepted Answer

Unauthorized access to sensitive customer records

Answer

A scheduled system maintenance window

Answer

An authorized penetration test discovering vulnerabilities

Answer

A user forgetting their password

Question 4

What term describes prioritizing security incidents based on their severity and potential impact?

Accepted Answer

Triage

Answer

Escalation

Answer

Remediation

Answer

Forensics

Question 5

Which of the following BEST describes the Recovery phase of incident response?

Accepted Answer

Restoring affected systems to normal and verified operation

Answer

Identifying the root cause of the incident

Answer

Notifying law enforcement about the breach

Answer

Capturing and preserving digital evidence

Question 6

What is the purpose of maintaining a chain of custody during incident response?

Accepted Answer

To track evidence handling and preserve its integrity for legal proceedings

Answer

To ensure all employees are aware of the incident

Answer

To document a timeline of system configuration changes

Answer

To assign accountability for causing the security incident

Question 7

Which type of incident response team is a full-time, permanently established team within an organization?

Accepted Answer

Dedicated CSIRT

Answer

Virtual CSIRT

Answer

Outsourced CSIRT

Answer

Distributed CSIRT