Incident Handling Process

During a suspected data breach, you must collect volatile memory. Which tool and command is the industry-standard starting point for capturing an image of RAM in a Windows-based incident?

Which role in the Incident Response Team is primarily responsible for ensuring that the incident handling activities remain aligned with organizational legal and privacy requirements?

You are managing chain of custody for a physical server seized during an investigation. What is the most critical action to ensure the evidence remains admissible in court?

You are performing a post-incident review. Which action is the most important to ensure that the 'Lessons Learned' process effectively improves future response capabilities?

You are setting up a secure communication channel for the IR team during a major incident. Why is it recommended to use an out-of-band communication method?

You are establishing an Incident Response Plan (IRP). Which document should prioritize the technical steps for restoring services after a ransomware attack?

You suspect an incident involves an insider threat. Which step should be taken FIRST to preserve the integrity of the potential evidence while minimizing system downtime?

A department head demands to know the names of the employees involved in an internal data leak. Which policy document defines your obligation to disclose or withhold this information?

You have identified a potential Advanced Persistent Threat (APT) in your network. Which evidence preservation strategy is required to maintain the validity of the logs found in a SIEM?

You are documenting a post-incident review. Which of the following should be included in the 'Timeline of Events' section?

During the identification phase, you notice a high volume of traffic from an unknown IP to your web server. What is the most appropriate action to take first?

When classifying the severity of an incident, which factor should carry the most weight in your decision-making process?

You are dealing with a legal hold request for data related to an investigation. How should you handle the data retention policy for this specific case?

An incident handler is reviewing an alert from the Endpoint Detection and Response (EDR) system. What is the main goal of the 'Containment' phase?

Which of the following activities is best suited for the 'Recovery' phase of the incident handling process?

What is the primary function of an Incident Response (IR) policy?

Which team should be notified first in the event of a confirmed external data breach involving customer PII?

When dealing with digital evidence in a remote investigation, what is the standard procedure to ensure evidence integrity during network transfer?

You are using a SIEM to correlate events during an investigation. What is the primary advantage of correlation in incident analysis?

You are preparing a final report for an incident. Which element is mandatory for ensuring the report serves as a valid document for future insurance or legal claims?

You are assessing the effectiveness of a containment strategy for a worm spreading through the network. What is the most effective metric to use?

During an incident, why is it important to keep the 'Incident Log' updated in real-time?

During an investigation, you need to verify the integrity of a system configuration file. You have the original known-good hash. What does it mean if the hash of the current file matches the known-good hash?

You are choosing a destination for forensic image storage. What is the most critical characteristic of this storage?

What is the primary purpose of the 'Preparation' phase in the incident response lifecycle?

When conducting an interview with a potential witness during an investigation, what is the best practice to follow?

Which TWO of the following are primary objectives of the 'Lessons Learned' phase?

Which TWO of the following are essential components of an effective Incident Response (IR) plan?

You are configuring a SIEM for long-term storage of investigation logs. Which feature is most important to prevent evidence tampering?

Which THREE of the following should be included in an incident communication plan?

Which THREE of the following are critical requirements for maintaining a valid Chain of Custody?

Which TWO of the following are common indicators that an incident should be declared?

Which TWO of the following actions are standard steps in the 'Analysis' phase of an incident?

Which THREE of the following roles are typically included in an IR team?

Which TWO of the following are recommended when creating a forensic copy of a hard drive?

Which TWO of the following are common sources for incident identification?

Which THREE of the following are legal considerations when handling an incident?

You are utilizing NIST SP 800-61 Rev. 2 to structure your incident response team. During a critical ransomware outbreak, you need to assign a lead who coordinates with legal, PR, and executive leadership. Which role should you designate to ensure organizational communication is handled per the policy?

While investigating a server compromise, you need to ensure the digital evidence collected from the RAID array is admissible in court. What is the most critical requirement for the chain of custody?

During the lessons learned phase of a P1 incident, you notice that the incident handling policy failed to define clear 'Rules of Engagement' for containment, leading to accidental service disruption. Which document should be updated to address this deficiency?

You are reviewing a failed incident case management report. The team failed to capture the 'Time of Detection' vs. 'Time of Occurrence'. Which metric is directly impacted by this lack of documentation?

You are performing an incident investigation involving a suspected insider threat. Under GDPR compliance, you must ensure that your data collection methods adhere to the 'data minimization' principle. Which action best aligns with this requirement?

An organization is establishing an Incident Response (IR) team. According to NIST, which team structure is most suitable for a large, globally distributed organization that requires localized response capability with centralized oversight?

Which TWO of the following are essential components of an effective Incident Communication Plan?

When managing the 'Lessons Learned' phase of the incident response lifecycle, which THREE activities should be conducted to ensure continuous improvement?

Which TWO of the following are considered 'Legal Considerations' during the Incident Handling process that must be integrated into the response plan?