ISC2 CC Incident Response 3

Question 1

Which of the following would MOST likely be classified as a high-severity incident requiring immediate escalation?

Accepted Answer

Ransomware encryption spreading across critical production servers

Answer

A user visiting a blocked website

Answer

A minor misconfiguration in a non-critical test system

Answer

An expired digital certificate on an internal development tool

Question 2

What is the formal document created to capture all details about a security incident for analysis and compliance purposes?

Accepted Answer

Incident Report

Answer

Audit Log

Answer

Vulnerability Assessment

Answer

Penetration Test Report

Question 3

When collecting digital evidence during incident response, what is MOST critical to ensure?

Accepted Answer

Evidence integrity is maintained

Answer

System performance metrics are captured

Answer

User credentials are preserved

Answer

Network bandwidth is documented

Question 4

After detecting a data breach, what should happen FIRST according to incident response best practices?

Accepted Answer

Contain the incident to limit further damage

Answer

Notify all affected customers immediately

Answer

Contact law enforcement

Answer

Perform a full forensic system audit

Question 5

What distinguishes a security 'incident' from a security 'event'?

Accepted Answer

An event is any observable occurrence; an incident is an event that threatens or violates security policy

Answer

Events are always malicious; incidents are accidental

Answer

Incidents are minor issues; events are critical threats

Answer

Events affect hardware systems; incidents affect software

Question 6

Which regulation requires organizations to report personal data breaches to supervisory authorities within 72 hours?

Accepted Answer

GDPR (General Data Protection Regulation)

Answer

ISO/IEC 27001

Answer

NIST SP 800-61

Answer

COBIT 2019

Question 7

What is a 'tabletop exercise' in the context of incident response preparedness?

Accepted Answer

A discussion-based exercise where participants walk through hypothetical incident scenarios

Answer

A physical inspection of server room security controls

Answer

A live simulation of a cyberattack on production systems

Answer

An automated tool that tests intrusion detection capabilities