Incident Response Process (Security+) Quiz

1. What is the purpose of creating a timeline during incident analysis?

To schedule future meetings

To understand the sequence of events and attack progression

To determine employee work schedules

To plan vacation time

2. After completing lessons learned, what should be updated in the organization?

Incident response procedures, training, and security controls

Only employee contact lists

Parking lot assignments

Nothing changes

3. Which metric is important to track during the Incident Response Process (Security+)?

Time to detect, contain, and recover

Employee vacation days

Office temperature

Coffee consumption

4. In containment, what does segmentation accomplish?

Prevents lateral movement of attackers

Increases network speed

Reduces software licenses

Improves employee morale

5. What is the role of an incident response team during the preparation phase?

Only responding to actual incidents

Training, drills, and establishing roles and responsibilities

Managing office supplies

Scheduling meetings exclusively

6. Which document is created during the lessons learned phase?

Incident report summarizing findings and improvements

Marketing brochure

Employee handbook

Quarterly sales report

7. During recovery, what should be prioritized for restoration?

Critical business systems and services first

All systems simultaneously

Non-essential systems only

Decorative office systems

8. What is the primary focus of forensic analysis during the detection phase?

Determining how the breach occurred and gathering evidence

Replacing all hardware

Changing all passwords immediately

Disconnecting the internet

9. Which phase involves testing backups and recovery procedures before an incident occurs?

Detection

Preparation

Containment

Lessons Learned

10. In the preparation phase, what does SIEM stand for?

Security Information and Event Management

System Integration and Error Monitoring

Security Incident Evaluation Module

Sensitive Information Entry Management

11. Which phase of incident response focuses on establishing tools, policies, and training before an incident occurs?

Detection and Analysis

Preparation

Containment

Recovery

12. Which communication step is critical during the initial detection phase of an incident?

Immediately posting details on social media

Notifying relevant stakeholders and incident response team

Waiting for full analysis before informing anyone

Only informing the CEO

13. During recovery, what must be verified after restoring a system?

The system boots without errors

All functionality works correctly and no malicious code remains

Only user accounts are functional

Network connectivity is restored

14. What is the primary difference between short-term and long-term containment?

Cost differences only

Short-term is temporary; long-term involves permanent fixes

They are identical approaches

Short-term requires more documentation

15. Which tool or resource is essential during the preparation phase of incident response?

Incident response plan and playbooks

Backup drives only

Email encryption software

Firewall logs exclusively

16. In incident response, what does 'lessons learned' typically include?

Only technical details of the attack

Post-incident review, improvements, and documentation of what occurred

Criminal charges against attackers

Hardware replacement recommendations

17. What is the eradication phase primarily responsible for accomplishing?

Restoring systems from clean backups

Removing the attacker's access and fixing vulnerabilities

Notifying affected customers

Analyzing malware signatures

18. Which containment strategy involves isolating a compromised system while maintaining logging and monitoring?

Cold containment

Warm containment

Hot containment

Passive containment

19. During the detection and analysis phase, what is the first critical action?

Shut down all affected systems immediately

Identify and confirm that a security incident has occurred

Notify law enforcement agencies

Begin system restoration procedures

20. What is the primary goal of the containment phase in incident response?

Prevent further damage and limit the scope of the incident

Restore all systems to normal operation

Identify the root cause of the attack

Document all findings for legal proceedings

IR Process Quiz: Can You Master Preparation to Lessons Learned?