ISC2 CC Incident Response Concepts Quiz

1. What is the primary goal of the eradication phase in incident response?

Identify the initial point of compromise

Remove the attacker's tools and access from the system

Restore systems to normal operations

Document all findings for legal proceedings

2. Which of the following is NOT a primary objective of incident response?

Minimize damage and loss

Restore normal operations

Increase IT department budget

Prevent recurrence

3. Which metric measures how quickly an organization detects a security incident?

Mean time to recovery (MTTR)

Mean time to detect (MTTD)

Recovery point objective (RPO)

Recovery time objective (RTO)

4. An incident response plan should be tested through tabletop exercises and simulations.

True

False

5. Which of the following best describes the containment phase?

Preventing further spread or impact of the incident

Notifying law enforcement of the breach

Completely removing all malware from systems

Conducting a full security audit

6. Which of the following is a key component of post-incident activities?

Lessons learned review

Updating incident response procedures

Improving security controls

All of the above

7. An organization's incident response team should include representatives from which departments?

IT and Security only

IT, Security, Legal, and Management

Security only

Executive leadership only

8. Which of the following best describes a zero-day vulnerability in the context of incident response?

A vulnerability patched within 24 hours

A previously unknown vulnerability with no available patch

A vulnerability affecting zero systems

A vulnerability discovered during incident analysis

9. True or False: Incident response procedures should only be documented after an incident occurs.

True

False

Submit

11. An incident response team should establish a communication plan before an incident occurs.

True

False

12. Which phase of incident response focuses on stopping the attack and limiting the damage?

Detection

Containment

Eradication

Recovery

Submit

14. Which type of backup is most critical for incident recovery?

Weekly incremental backups

Offline, isolated, tested backups

Real-time cloud backups only

Monthly full backups

15. Forensic analysis should be conducted during the detection phase before any remediation begins.

True

False

16. Which framework defines four phases: preparation, detection and analysis, containment, eradication, and recovery?

NIST Cybersecurity Framework

SANS Incident Response Model

ISO 27035

CIS Controls

17. Which of the following is NOT typically part of an incident response plan?

Roles and responsibilities

Communication procedures

Marketing strategy

Escalation procedures

Submit

ISC2 CC Incident Response Concepts Quiz

1. What is the primary goal of the eradication phase in incident response?

2.

What first name or nickname would you like us to use?

2. Which of the following is NOT a primary objective of incident response?

3. Which metric measures how quickly an organization detects a security incident?

4. An incident response plan should be tested through tabletop exercises and simulations.

5. Which of the following best describes the containment phase?

6. Which of the following is a key component of post-incident activities?

7. An organization's incident response team should include representatives from which departments?

8. Which of the following best describes a zero-day vulnerability in the context of incident response?

9. True or False: Incident response procedures should only be documented after an incident occurs.

10. The ____ phase involves restoring systems to normal operations after an incident.

11. An incident response team should establish a communication plan before an incident occurs.

12. Which phase of incident response focuses on stopping the attack and limiting the damage?

13. The ____ is the time between when a breach occurs and when it is detected.

14. Which type of backup is most critical for incident recovery?

15. Forensic analysis should be conducted during the detection phase before any remediation begins.

16. Which framework defines four phases: preparation, detection and analysis, containment, eradication, and recovery?

17. Which of the following is NOT typically part of an incident response plan?

18. The ____ is the process of identifying and analyzing suspicious events on a network or system.

19. The ____ is the maximum acceptable downtime for a critical system before business impact becomes severe.