CySA Plus V3 Incident Escalation and Coordination

1. When should an incident be escalated to executive leadership?

Only if the CEO specifically requests it

When incident impact affects business operations or involves regulatory compliance

After all technical remediation is complete

Never, executives should not be involved in incident response

2. What is a critical advantage of using an incident management platform during escalation?

It eliminates the need for any human involvement

It ensures centralized tracking, visibility, and coordination across all response teams

It guarantees incidents will never happen again

It removes the need for documentation

3. True or False: An incident escalation procedure should be tested and updated regularly.

True

False

4. Which external stakeholder must typically be notified during a breach involving personally identifiable information (PII)?

Competitors

Regulatory bodies and affected individuals

Anonymous internet forums

Random third-party vendors

5. What is the term for the person or role ultimately accountable for incident response decisions?

Incident Coordinator

Incident Commander or Incident Response Lead

Security Guard

Help Desk Technician

6. True or False: Communication during incident escalation should be limited to written emails only.

True

False

7. Which of the following best defines 'incident severity'?

The number of people involved in responding

The potential impact and urgency of the incident

The age of the affected systems

The location of the affected servers

8. What is the primary purpose of maintaining an incident escalation log?

To track escalation decisions, timelines, and stakeholder notifications for compliance and improvement

To punish employees involved in incidents

To prevent future incidents from occurring

To share incident details publicly on social media

9. True or False: Customer notification decisions should be made solely by the IT department.

True

False

10. Which stakeholder group is responsible for determining legal and regulatory notification requirements?

Help desk staff

Legal and compliance teams

Janitorial staff

Vendor support teams

11. Which of the following best describes the primary purpose of incident escalation?

To involve senior management and appropriate stakeholders when incident severity warrants additional resources or expertise

To immediately shut down all affected systems

To document all incident details for legal purposes only

To notify external vendors before internal teams

12. What does the acronym IRP stand for in incident management?

Incident Response Plan

Internal Risk Protocol

Integrated Remediation Process

Information Recovery Procedure

13. True or False: Legal and compliance teams should always be notified during data breach incidents.

True

False

14. Which of the following is a key component of an effective incident coordination plan?

Clear communication channels and contact information

Keeping incident details secret from all departments

Avoiding documentation of any kind

Limiting incident response to IT personnel only

15. What is the primary benefit of establishing clear escalation procedures before an incident occurs?

Reduces response time and prevents confusion during critical events

Eliminates the need for incident documentation

Guarantees no incidents will occur

Removes the need for technical expertise

16. Which communication method is typically most appropriate for escalating critical incidents?

Email only

Instant messaging without confirmation

Direct phone call or established alert system

Waiting for the next scheduled meeting

17. True or False: A low-severity incident should bypass the escalation process entirely.

True

False

18. What does RACI matrix stand for in incident coordination?

Responsible, Accountable, Consulted, Informed

Rapid, Alert, Critical, Immediate

Response, Action, Communication, Investigation

Risk, Analysis, Control, Impact

19. Which stakeholder should typically be notified first during a critical security incident?

External regulatory bodies

The incident response team lead or security operations center

All employees via email

Social media followers

20. What is the typical first step in an incident escalation process?

Notify law enforcement

Assess incident severity and determine escalation criteria

Isolate all network segments

Terminate all user sessions

CySA Plus V3 Incident Escalation and Coordination Quiz

1. When should an incident be escalated to executive leadership?

2.

What first name or nickname would you like us to use?

2. What is a critical advantage of using an incident management platform during escalation?

3. True or False: An incident escalation procedure should be tested and updated regularly.

4. Which external stakeholder must typically be notified during a breach involving personally identifiable information (PII)?

5. What is the term for the person or role ultimately accountable for incident response decisions?

6. True or False: Communication during incident escalation should be limited to written emails only.

7. Which of the following best defines 'incident severity'?

8. What is the primary purpose of maintaining an incident escalation log?

9. True or False: Customer notification decisions should be made solely by the IT department.

10. Which stakeholder group is responsible for determining legal and regulatory notification requirements?

11. Which of the following best describes the primary purpose of incident escalation?

12. What does the acronym IRP stand for in incident management?

13. True or False: Legal and compliance teams should always be notified during data breach incidents.

14. Which of the following is a key component of an effective incident coordination plan?

15. What is the primary benefit of establishing clear escalation procedures before an incident occurs?

16. Which communication method is typically most appropriate for escalating critical incidents?

17. True or False: A low-severity incident should bypass the escalation process entirely.

18. What does RACI matrix stand for in incident coordination?

19. Which stakeholder should typically be notified first during a critical security incident?

20. What is the typical first step in an incident escalation process?