Incident Response Planning Quiz

1. What is the primary purpose of a post-incident review meeting?

To assign blame to team members

To identify lessons learned and improve future response

To document evidence for prosecution

To terminate affected employees

2. What is the primary objective of conducting regular incident response drills?

To waste time and resources

To identify gaps and improve team readiness

To eliminate the need for formal planning

To reduce insurance premiums only

3. Which of the following is a critical component of an incident response plan?

Defined roles and responsibilities

Contact information for the incident response team

Escalation procedures

All of the above

4. In incident response, what does 'playbook' refer to?

A list of all employees

Pre-defined procedures for responding to specific incident types

A marketing document

A software application for data analysis

5. What is the primary advantage of using a Security Information and Event Management (SIEM) system?

It eliminates all security incidents

It centralizes log collection and enables faster threat detection

It replaces the need for firewalls

It automatically patches all vulnerabilities

6. Which incident severity level typically requires immediate isolation and executive notification?

Low

Medium

Critical

Informational

7. In forensic analysis, what does 'volatility' refer to?

The speed of data transmission

The likelihood that data will be lost if not preserved

The encryption strength of a system

The frequency of system backups

8. What is the primary goal of threat hunting in incident response preparation?

To sell security products

To identify undetected threats before they cause damage

To replace intrusion detection systems

To eliminate all false positives

9. Which regulation typically requires breach notification within a specific timeframe?

SOX (Sarbanes-Oxley)

HIPAA and GDPR

PCI DSS only

ISO 27001 only

10. In incident response, what does 'eradication' involve?

Removing the threat and closing all vulnerabilities

Backing up all affected systems

Notifying customers of the breach

Purchasing new security software

11. What is the primary goal of the containment phase in incident response?

Eliminate all malware from the system

Stop the attack from spreading to other systems

Document all forensic evidence

Notify external law enforcement agencies

12. Which log source is most valuable for investigating lateral movement in an incident?

Web server access logs

DNS query logs

Windows Event Viewer and Sysmon logs

Printer activity logs

13. What is the primary benefit of implementing network segmentation before an incident occurs?

It eliminates all cyber threats

It limits lateral movement and containment scope

It prevents all data exfiltration

It removes the need for firewalls

14. In incident response, what is the purpose of a communication plan?

To encrypt all incident reports

To coordinate messaging with stakeholders and regulators

To prevent employees from discussing the breach

To delay public disclosure indefinitely

15. Which metric measures the time between breach occurrence and detection?

Mean Time to Recovery (MTTR)

Mean Time to Detect (MTTD)

Recovery Time Objective (RTO)

Recovery Point Objective (RPO)

16. What does a tabletop exercise in incident response planning involve?

Simulating a real attack on live systems

Team discussion of hypothetical scenarios

Penetration testing of network infrastructure

Analyzing historical breach data

17. Which type of backup is most critical for business continuity during an incident?

Incremental backups

Differential backups

Offline or air-gapped backups

Real-time cloud backups

18. What is the first step in incident response planning?

Isolate affected systems

Establish an incident response team

Conduct a damage assessment

Notify stakeholders

19. In forensic investigation, what does the chain of custody ensure?

That evidence remains admissible in court

That data is encrypted during collection

That all malware is removed

That systems are restored immediately

20. Which incident response framework is based on four phases: preparation, detection, containment, and recovery?

NIST Cybersecurity Framework

SANS Incident Handling Model

ISO/IEC 27035

ITIL Service Management

General Security Advanced Incident Response Planning Quiz