PLC Data Breach Response & Incident Management 2

Question 1

An organization's incident response plan (IRP) should be tested using tabletop exercises at minimum how often, according to NIST SP 800-61 guidance?

Accepted Answer

Annually

Answer

NIST SP 800-61 recommends that incident response plans be reviewed and tested at least annually to ensure effectiveness and currency.

Question 2

Which term describes the process of preserving digital evidence in a forensically sound manner following a data breach?

Accepted Answer

Chain of custody

Answer

Chain of custody refers to the documented process of collecting, preserving, and handling digital evidence so it remains admissible and unaltered.

Question 3

A US company experiences a breach affecting EU residents' data. Under GDPR, if the breach is unlikely to result in a risk to individuals' rights, the company must:

Accepted Answer

Document the breach internally without notifying authorities

Answer

GDPR Article 33(1) states that breaches unlikely to result in risk to individuals' rights need not be reported to supervisory authorities but must be documented internally.

Question 4

Which phase of NIST's incident response lifecycle involves activities to stop the spread of an incident and prevent further damage?

Accepted Answer

Containment, Eradication, and Recovery

Answer

The Containment, Eradication, and Recovery phase focuses on stopping the incident spread, removing the threat, and restoring normal operations.

Question 5

What is the purpose of a 'post-mortem' or 'lessons learned' meeting after a data breach incident?

Accepted Answer

To identify what worked, what failed, and how to improve future response

Answer

Post-incident reviews identify gaps in preparation, response, and recovery to strengthen the organization's future incident handling capabilities.

PLC - Privacy Law Certification Practice Test

PLC - Privacy Law Certification Practice Test

PLC Data Breach Response & Incident Management 2