ISC2 CC Incident Response 3

Question 1

Which of the following would MOST likely be classified as a high-severity incident requiring immediate escalation?

Accepted Answer

Ransomware encryption spreading across critical production servers

Answer

Ransomware spreading across critical production servers directly threatens the availability and integrity of critical organizational assets, making it the highest severity.

Question 2

What is the formal document created to capture all details about a security incident for analysis and compliance purposes?

Accepted Answer

Incident Report

Answer

An Incident Report is the formal documentation capturing all relevant details about a security incident for analysis, compliance, and future reference.

Question 3

When collecting digital evidence during incident response, what is MOST critical to ensure?

Accepted Answer

Evidence integrity is maintained

Answer

Maintaining evidence integrity ensures that digital evidence accurately reflects the state of systems at the time of the incident and is admissible in legal proceedings.

Question 4

After detecting a data breach, what should happen FIRST according to incident response best practices?

Accepted Answer

Contain the incident to limit further damage

Answer

Containment should occur first to stop the spread and limit the damage of the breach before notification, investigation, or other activities proceed.

Question 5

What distinguishes a security 'incident' from a security 'event'?

Accepted Answer

An event is any observable occurrence; an incident is an event that threatens or violates security policy

Answer

An event is any observable occurrence in a system or network, while an incident is an event that actually violates or imminently threatens the violation of security policies.

ISC2 CC - ISC2 Certified in Cybersecurity Practice Test

ISC2 CC - ISC2 Certified in Cybersecurity Practice Test

ISC2 CC Incident Response 3