A+ V14 Data Breach Response Procedures

1. During breach notification, which information should NOT be disclosed to prevent further risk?

Specific attack vectors and exploited vulnerabilities

The date the breach was discovered

The number of records affected

Contact information for support

2. Which of the following is a best practice for documenting a data breach incident?

Record timeline, affected systems, actions taken, and findings in detail

Avoid written documentation

Document only what you remember

Share all details publicly

3. In the context of operational procedures, what does 'business continuity' mean during a breach?

Maintaining critical operations while addressing the breach and minimizing downtime

Shutting down all business operations

Ignoring customer needs

Deleting all company data

4. What role does threat intelligence play in breach response procedures?

Identifying threat patterns and improving detection and prevention measures

Increasing incident response time

Eliminating all security controls

Avoiding regulatory compliance

5. Which log types are most critical to preserve during a breach investigation?

System, network, application, and authentication logs

Only marketing emails

No logs need preservation

Only deleted files

6. When should backup systems be used during a breach recovery?

Only after confirming the breach is contained and backups are uncompromised

Immediately without verification

Never, to preserve evidence

Only after notifying competitors

7. What is a key responsibility of the incident response team leader?

Coordinating response efforts and ensuring communication among all stakeholders

Working alone without consulting others

Ignoring the incident

Deleting evidence

8. Which communication channel should be used to notify executives of a critical data breach?

Secure, direct communication through established incident response protocols

Public social media announcement

Unsecured email

Delaying notification indefinitely

9. In incident response, what does 'detection and analysis' primarily involve?

Identifying the breach and determining its scope and impact

Immediately restoring all systems

Notifying competitors of the breach

Deleting all security logs

10. What is the purpose of implementing network segmentation in breach response procedures?

To prevent lateral movement of attackers between systems

To increase internet speed

To reduce IT staff workload

To eliminate all firewalls

11. When a data breach is detected, what is the first critical step an IT professional should take?

Isolate affected systems from the network

Notify all customers immediately

Delete logs to prevent exposure

Restore from backup without investigation

12. What is the primary benefit of conducting a post-incident review after a data breach?

To identify lessons learned and improve future response procedures

To blame employees for the incident

To avoid discussing the breach

To reduce compliance requirements

13. Which of the following is a best practice for password management after a suspected breach?

Force all users to change passwords immediately

Keep the same passwords for continuity

Share passwords via email for security

Use the same password for all accounts

14. In the context of breach response, what is 'recovery' primarily focused on?

Restoring normal operations while ensuring the breach is fully resolved

Firing all IT staff

Ignoring the incident

Selling company data

15. What does the 'eradication' phase of incident response involve?

Identifying and removing the root cause of the breach

Notifying customers of the incident

Backing up all affected data

Shutting down the organization

16. During a breach investigation, chain of custody documentation is important for which reason?

To track evidence handling and maintain legal admissibility

To speed up the investigation process

To reduce insurance claims

To avoid notifying authorities

17. Which regulatory framework typically requires organizations to notify affected parties of a data breach?

GDPR and state privacy laws

Internal IT policy only

Marketing department guidelines

No notification is legally required

18. What is the primary purpose of creating an incident response plan before a breach occurs?

To eliminate all security risks

To define roles, procedures, and communication protocols for effective response

To guarantee zero downtime

To avoid regulatory compliance

19. In incident response, containment typically involves which actions?

Stopping the spread of the breach and limiting damage

Immediately shutting down all systems

Notifying law enforcement only

Restoring all data from backup

20. Which of the following best describes the purpose of evidence preservation during a breach incident?

To delete suspicious files quickly

To maintain forensic integrity for investigation and legal proceedings

To speed up system recovery time

To reduce notification costs

A+ V14 Data Breach Response Procedures Quiz