ISP ISP Security Investigations & Incident Response

Question 1

Which phase of an incident response plan involves returning systems to normal operations after a security event?

Accepted Answer

Recovery

Answer

The recovery phase restores affected systems and verifies they are clean and functional before returning them to production.

Question 2

What is the primary legal reason for maintaining a 'chain of custody' during a security investigation?

Accepted Answer

To preserve the integrity and admissibility of evidence in legal or disciplinary proceedings

Answer

Proper chain of custody documents who handled evidence and when, ensuring it has not been tampered with and remains legally admissible.

Question 3

A security investigator discovers a suspicious USB drive in a secured area. The FIRST action should be:

Accepted Answer

Photograph it in place, document its location, and secure it as evidence without inserting it into any system

Answer

Documenting and preserving the device without connecting it protects both evidence integrity and facility systems from potential malware.

Question 4

An industrial security investigation MUST remain within which legal boundary when interviewing employees?

Accepted Answer

Employees must be informed of their rights, and interviews must comply with applicable labor and employment law

Answer

Industrial security investigations must respect labor laws, privacy rights, and employee rights to counsel to avoid legal liability.

Question 5

Which type of investigation focuses specifically on determining the root cause of a security system failure rather than identifying a perpetrator?

Accepted Answer

Root cause analysis (RCA) / technical investigation

Answer

RCA investigations analyze system failures, process gaps, or equipment malfunctions to prevent recurrence rather than to assign criminal liability.

(ISP) Industrial Security Professional Certification Practice Test