GCIH Incident Handling Process Quiz

1. What does chain of custody protect in incident investigation?

The integrity and admissibility of evidence

The physical location of the incident

The identity of the attacker

The speed of system recovery

2. What is the purpose of a tabletop exercise in incident preparedness?

Simulate and practice incident response without actual systems

Replace formal incident response procedures

Train only executive leadership

Identify all vulnerabilities in the network

3. Which communication protocol is essential during a major incident?

Established escalation paths and regular status updates

Email only to all staff members

Social media announcements

No communication until fully resolved

Submit

5. What is the primary goal of threat intelligence in incident response?

Understand attacker capabilities, tactics, and motivations

Create marketing campaigns

Reduce IT infrastructure costs

Improve employee morale

6. True or False: Logs should be preserved in their original format without modification during forensic analysis.

True

False

7. What is the primary purpose of establishing an incident severity scale?

Prioritize resource allocation and response speed

Determine employee salaries

Predict future incidents

Eliminate all security risks

Submit

9. Which tool is commonly used to collect volatile memory from a live system?

Volatility

Wireshark

Nmap

Burp Suite

10. True or False: Incident response procedures should never be tested until a real incident occurs.

True

False

11. What is the primary goal of the incident detection phase?

Identify and recognize security incidents as early as possible

Eliminate all malware from the system

Notify management of the incident

Restore systems to normal operation

12. Which of these is a key component of an effective incident response team?

Clear roles and responsibilities

Marketing department representation

Only IT staff involvement

No external communication protocols

Submit

14. What is the primary function of a Security Information and Event Management (SIEM) system?

Collect, correlate, and analyze security event logs in real-time

Encrypt all network traffic

Physically secure data centers

Create backup copies of databases

15. True or False: A forensic image should be taken before any remediation efforts.

True

False

16. Which phase involves returning systems to normal operations after an incident?

Detection

Containment

Recovery

Analysis

17. What is the main purpose of the eradication phase?

Remove the cause of the incident from all systems

Document the incident for legal purposes

Notify affected customers immediately

Implement new firewall rules

Submit

19. What does IRP stand for in incident management?

Incident Response Plan

Information Recovery Protocol

Integrated Risk Procedure

Incident Reporting Platform

20. Which of the following is NOT a common incident classification level?

Low

Medium

High

Catastrophic

GCIH Incident Handling Process Quiz

1. What does chain of custody protect in incident investigation?

2.

What first name or nickname would you like us to use?

2. What is the purpose of a tabletop exercise in incident preparedness?

3. Which communication protocol is essential during a major incident?

4. During containment, the team must balance ____ with minimizing impact on business operations.

5. What is the primary goal of threat intelligence in incident response?

6. True or False: Logs should be preserved in their original format without modification during forensic analysis.

7. What is the primary purpose of establishing an incident severity scale?

8. The incident response process typically begins with ____ and ends with recovery.

9. Which tool is commonly used to collect volatile memory from a live system?

10. True or False: Incident response procedures should never be tested until a real incident occurs.

11. What is the primary goal of the incident detection phase?

12. Which of these is a key component of an effective incident response team?

13. During post-incident analysis, the team should focus on ____.

14. What is the primary function of a Security Information and Event Management (SIEM) system?

15. True or False: A forensic image should be taken before any remediation efforts.

16. Which phase involves returning systems to normal operations after an incident?

17. What is the main purpose of the eradication phase?

18. During containment, short-term containment typically focuses on ____.

19. What does IRP stand for in incident management?

20. Which of the following is NOT a common incident classification level?