ISC2 CC Incident Response 2

Question 1

What is the goal of the Eradication phase in incident response?

Accepted Answer

Removing the root cause and malicious artifacts from affected systems

Answer

The Eradication phase focuses on removing malware, closing exploited vulnerabilities, and eliminating the root cause of the incident.

Question 2

'Lessons learned' activities primarily occur during which phase of the incident response lifecycle?

Accepted Answer

Post-Incident Activity

Answer

Post-Incident Activity includes conducting lessons learned meetings to evaluate the response, improve processes, and update documentation for future incidents.

Question 3

Which of the following BEST represents a security incident?

Accepted Answer

Unauthorized access to sensitive customer records

Answer

Unauthorized access to sensitive customer records is an actual security incident because it violates the confidentiality of protected information without authorization.

Question 4

What term describes prioritizing security incidents based on their severity and potential impact?

Accepted Answer

Triage

Answer

Triage is the process of evaluating and prioritizing incidents based on their potential impact and urgency so the most critical issues are addressed first.

Question 5

Which of the following BEST describes the Recovery phase of incident response?

Accepted Answer

Restoring affected systems to normal and verified operation

Answer

The Recovery phase involves restoring affected systems to full, verified operational status after the incident has been contained and eradicated.

ISC2 CC - ISC2 Certified in Cybersecurity Practice Test

ISC2 CC - ISC2 Certified in Cybersecurity Practice Test

ISC2 CC Incident Response 2