ISC2 CC Incident Response Concepts Quiz

Submit

2. Which of the following is NOT a primary objective of incident response?

Minimize damage and loss

Restore normal operations

Increase IT department budget

Prevent recurrence

Submit

4. Which metric measures how quickly an organization detects a security incident?

Mean time to recovery (MTTR)

Mean time to detect (MTTD)

Recovery point objective (RPO)

Recovery time objective (RTO)

5. An incident response plan should be tested through tabletop exercises and simulations.

True

False

6. Which of the following best describes the containment phase?

Preventing further spread or impact of the incident

Notifying law enforcement of the breach

Completely removing all malware from systems

Conducting a full security audit

Submit

8. Which of the following is a key component of post-incident activities?

Lessons learned review

Updating incident response procedures

Improving security controls

All of the above

9. Forensic analysis should be conducted during the detection phase before any remediation begins.

True

False

10. Which type of backup is most critical for incident recovery?

Weekly incremental backups

Offline, isolated, tested backups

Real-time cloud backups only

Monthly full backups

11. Which phase of incident response focuses on stopping the attack and limiting the damage?

Detection

Containment

Eradication

Recovery

12. An organization's incident response team should include representatives from which departments?

IT and Security only

IT, Security, Legal, and Management

Security only

Executive leadership only

13. Which of the following best describes a zero-day vulnerability in the context of incident response?

A vulnerability patched within 24 hours

A previously unknown vulnerability with no available patch

A vulnerability affecting zero systems

A vulnerability discovered during incident analysis

14. True or False: Incident response procedures should only be documented after an incident occurs.

True

False

15. Which framework defines four phases: preparation, detection and analysis, containment, eradication, and recovery?

NIST Cybersecurity Framework

SANS Incident Response Model

ISO 27035

CIS Controls

Submit

17. Which of the following is NOT typically part of an incident response plan?

Roles and responsibilities

Communication procedures

Marketing strategy

Escalation procedures

18. An incident response team should establish a communication plan before an incident occurs.

True

False

19. What is the primary goal of the eradication phase in incident response?

Identify the initial point of compromise

Remove the attacker's tools and access from the system

Restore systems to normal operations

Document all findings for legal proceedings

ISC2 CC Incident Response Concepts Quiz

1. The ____ is the time between when a breach occurs and when it is detected.

2.

What first name or nickname would you like us to use?

2. Which of the following is NOT a primary objective of incident response?

3. The ____ is the maximum acceptable downtime for a critical system before business impact becomes severe.

4. Which metric measures how quickly an organization detects a security incident?

5. An incident response plan should be tested through tabletop exercises and simulations.

6. Which of the following best describes the containment phase?

7. The ____ is the process of identifying and analyzing suspicious events on a network or system.

8. Which of the following is a key component of post-incident activities?

9. Forensic analysis should be conducted during the detection phase before any remediation begins.

10. Which type of backup is most critical for incident recovery?

11. Which phase of incident response focuses on stopping the attack and limiting the damage?

12. An organization's incident response team should include representatives from which departments?

13. Which of the following best describes a zero-day vulnerability in the context of incident response?

14. True or False: Incident response procedures should only be documented after an incident occurs.

15. Which framework defines four phases: preparation, detection and analysis, containment, eradication, and recovery?

16. The ____ phase involves restoring systems to normal operations after an incident.

17. Which of the following is NOT typically part of an incident response plan?

18. An incident response team should establish a communication plan before an incident occurs.

19. What is the primary goal of the eradication phase in incident response?