ISO 27000 Foundation Certification Information Security Incident Management 3

Question 1

What is the purpose of an incident communication plan in information security?

Accepted Answer

To define how, when, and to whom information about incidents is communicated

Answer

An incident communication plan defines who must be notified, what information to share, when to communicate, and through which channels, covering both internal and external stakeholders.

Question 2

What does 'dwell time' refer to in the context of information security incidents?

Accepted Answer

The period an attacker remains undetected within a compromised system

Answer

Dwell time is the period between when an attacker first gains access to a system and when the breach is detected; shorter dwell time generally means less damage.

Question 3

Which concept best describes 'lessons learned' in incident management?

Accepted Answer

A structured post-incident review to identify improvements in prevention and response

Answer

Lessons learned is a post-incident review process where the organization examines what happened, evaluates the response, and identifies actionable improvements to prevent or better handle future incidents.

Question 4

According to ISO 27000, what is a 'threat' in information security?

Accepted Answer

A potential cause of an unwanted incident that may result in harm to assets

Answer

ISO 27000 defines a threat as a potential cause of an unwanted incident which may result in harm to a system or organization — it is a potential, not necessarily realized, source of harm.

Question 5

What is the key difference between reactive and proactive incident management approaches?

Accepted Answer

Proactive management involves threat hunting before incidents occur; reactive management responds after detection

Answer

Proactive incident management involves activities like threat hunting to find threats before they cause incidents, while reactive management activates response procedures after an incident is detected.

ISO 27000 Foundation Certification Practice Test

ISO 27000 Foundation Certification Practice Test

ISO 27000 Foundation Certification Information Security Incident Management 3