- An organization's incident response plan designates a Computer Security Incident Response Team (CSIRT). The CSIRT should include representatives from which functions?
Answer: IT security, IT operations, legal, communications/PR, HR, and relevant business units - reflecting the cross-functional nature of incident response.
Effective incident response requires cross-functional coordination: IT handles technical response, legal manages liability and regulatory obligations, communications manages external messaging, HR addresses employee-related matters, and business units understand business impact. Answer C is correct. Technical staff alone (A) cannot manage legal, PR, or business implications. Management and legal alone (B) cannot execute technical response. External agencies (D) may be involved but do not constitute the internal CSIRT.
- When a breach notification is sent to affected individuals, which of the following information should typically be included?
Answer: A description of what happened, the types of information involved, what the organization is doing in response, steps individuals can take to protect themselves, and contact information for further assistance.
Breach notifications should be clear and actionable - explaining the incident, what data was affected, organizational response actions, protective steps individuals can take, and how to get help. Answer A is correct. Technical attack details (B) are not helpful to individuals and may aid further attacks. Employee names (C) are confidential. Full data inventories (D) are not required and may raise additional privacy concerns.
- A major financial institution experiences a cybersecurity incident that disrupts trading systems for 4 hours. Under applicable financial sector regulations, which of the following reporting obligations most likely apply?
Answer: The institution must notify its primary financial regulator (e.g., OCC, Federal Reserve, FDIC) within the timeframes specified by applicable regulations, which may be as short as 36-72 hours for significant operational disruptions.
Financial sector regulations (including the federal banking agencies' Computer-Security Incident Notification Rule) require prompt notification to primary regulators for significant cybersecurity incidents. Answer D is correct. Duration alone does not exempt incidents from reporting (A). Board notification (B) is internal governance. Law enforcement notification (C) may also be appropriate but is separate from regulatory reporting.
- A company discovers a data breach involving customer financial information on a Friday evening. Under most breach notification laws (such as GDPR's 72-hour requirement), the organization's first obligation is to:
Answer: Begin assessing the scope and nature of the breach immediately, as regulatory notification timelines start from when the organization becomes aware of the breach.
Breach notification clocks typically start when the organization becomes aware - GDPR's 72-hour supervisory authority notification requirement does not pause for weekends or investigations. Immediate scoping and assessment is essential. Answer D is correct. Waiting until Monday (A) risks missing notification deadlines. Customer notification (B) typically follows regulatory notification. A complete investigation (C) may take far longer than notification deadlines allow.
- Which of the following correctly identifies the phases of a typical incident response lifecycle?
Answer: Preparation, Detection and Analysis, Containment, Eradication, Recovery, and Post-Incident Activity
The NIST SP 800-61 incident response lifecycle has six phases: Preparation, Detection and Analysis, Containment, Eradication and Recovery, and Post-Incident Activity. Answer C is correct. Answer A is COBIT management phases. Answer B is the NIST Cybersecurity Framework functions. Answer D is a generic process model.
- Which of the following scenarios would trigger a SEC cybersecurity incident disclosure requirement for a publicly traded company under the SEC's 2023 cybersecurity disclosure rules?
Answer: A cybersecurity incident that the company determines is material - requiring disclosure within four business days on Form 8-K.
The SEC's 2023 cybersecurity rules require public companies to disclose material cybersecurity incidents on Form 8-K within four business days of determining the incident is material. Answer C is correct. Disclosure is not required for all incidents (A). Materiality is broader than just customer data theft (B). The rules apply to all material incidents, not just international ones (D).
- During incident response, forensic preservation of evidence requires that:
Answer: Evidence be collected in a forensically sound manner - using write blockers, creating verified copies, and maintaining a chain of custody - to preserve its integrity for potential legal proceedings.
Forensic evidence collection requires specialized techniques (write blockers to prevent modification, verified copies, chain of custody documentation) to ensure evidence is admissible and credible for legal or regulatory proceedings. Answer C is correct. Immediate shutdown (A) may destroy volatile evidence. Restoring before collecting (B) destroys evidence. Deleting logs (D) is obstruction.
- Which of the following is the most important document to maintain during an incident for both operational and legal purposes?
Answer: A detailed incident log recording all actions taken, decisions made, timestamps, personnel involved, and evidence collected throughout the response.
A detailed incident log provides the authoritative record of what happened, when, by whom, and why - essential for regulatory reporting, legal proceedings, lessons learned, and demonstrating due diligence. Answer A is correct. Backups (B) are important for recovery. Employee notification lists (C) are one element of documentation. Insurance policies (D) are business documents, not incident records.
- Under GDPR, when must organizations notify the relevant supervisory authority following a personal data breach?
Answer: Within 72 hours of becoming aware of the breach, where feasible, unless the breach is unlikely to result in risk to individuals.
GDPR Article 33 requires supervisory authority notification within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to result in risk to individuals' rights and freedoms. Answer D is correct. 24 hours (A) is too short and not required. 30 days (B) exceeds the requirement. The threshold is not based on individual count (C).
- Following a cybersecurity incident, a post-incident review (also called a post-mortem or lessons learned) is conducted primarily to:
Answer: Analyze what happened, how the incident was handled, what could be improved, and what actions will strengthen defenses and prevent recurrence.
Post-incident reviews focus on improvement - understanding the attack chain, evaluating response effectiveness, identifying gaps, and implementing enhancements. They are blameless process improvement exercises. Answer B is correct. Assigning blame (A) is counterproductive. Insurance reporting (C) and regulatory evidence (D) may result from the review but are not its primary purpose.
- Which of the following best describes the purpose of a 'tabletop exercise' in incident response preparedness?
Answer: A discussion-based exercise where team members walk through a simulated incident scenario to test their understanding of roles, procedures, and decision-making without activating actual systems.
Tabletop exercises test incident response knowledge and coordination through discussion of simulated scenarios - identifying gaps in procedures, communication, and decision-making without the risk and cost of live exercises. Answer A is correct. Full system failover (B) is a full-scale exercise. Physical security drills (C) test physical controls. Policy reviews (D) assess documentation.
- During a ransomware incident, the IT team's first priority should be to:
Answer: Contain the attack by isolating infected systems from the network to prevent further spread before beginning investigation or recovery.
Containment - isolating affected systems - is the first priority to stop ransomware from spreading to additional systems. Investigation, notification, and recovery follow containment. Answer A is correct. Paying ransom (B) is a last resort. Root cause analysis (C) occurs after containment. Customer notification (D) follows assessment of data exposure.
- An organization learns that a former employee may have exfiltrated sensitive financial data before leaving. Which of the following is the most appropriate first step in the incident response process?
Answer: Preserve relevant evidence - including access logs, email records, and system activity - before taking any action that might alert the former employee or destroy evidence.
Evidence preservation is the critical first step - disabling accounts and preserving logs before the former employee can be alerted or evidence is overwritten. Answer A is correct. Contacting the former employee (B) alerts them and may result in evidence destruction. Customer notification (C) is premature before scope is determined. System restoration (D) may destroy evidence and is premature.
- Which of the following is the most critical element of an effective incident response plan?
Answer: Clearly defined roles and responsibilities, escalation paths, decision authorities, and communication protocols - ensuring every team member knows their role before an incident occurs.
Clarity about who does what, who decides what, and how information flows is the foundation of effective incident response - confusion about roles during an active incident wastes critical time. Answer B is correct. Asset inventories (A) support response but are not the most critical IR element. Threat actor lists (C) and MSSP contracts (D) support security programs but are not foundational to IR plan effectiveness.
- A company's incident response plan has not been updated in three years and does not reflect the current IT infrastructure, key contacts, or regulatory requirements. The primary risk of this outdated plan is:
Answer: During an actual incident, the team will follow incorrect procedures, contact wrong personnel, and miss regulatory obligations - increasing incident impact and legal exposure.
An outdated IR plan leads to confusion, delays, and missed obligations during an actual incident - exactly when clarity and speed matter most. Answer B is correct. External auditors may note the gap (A) but the operational risk is more significant. Insurance premiums (C) are not automatically affected. Training (D) is unrelated.
- Under U.S. state breach notification laws, notification to affected individuals is generally required when:
Answer: A breach involves specific categories of sensitive personal information (such as SSNs, financial account numbers, or medical information) and the data was not encrypted or otherwise protected.
Most U.S. state breach notification laws trigger individual notification when defined categories of sensitive personal information (PII, financial data, health data) are compromised - particularly when unencrypted. Answer D is correct. Not all unauthorized access triggers notification (A). Thresholds (B) vary by state. Legal triggers, not customer service decisions (C), mandate notification.
- An organization's incident response plan requires that any incident involving personal data be escalated to the privacy officer within 4 hours of identification. During an audit, the auditor finds that 6 of 10 sampled incidents involving personal data were not escalated to the privacy officer at all. The auditor should:
Answer: Report this as a significant finding - the escalation control did not operate as designed, creating risk that breach notification obligations were not assessed or triggered for multiple incidents.
A 60% failure rate in escalating personal data incidents to the privacy officer means notification obligations were likely not assessed - a significant compliance and legal risk. Answer B is correct. Resolution of incidents (A) does not substitute for proper escalation. Officer availability (C) is irrelevant if escalation did not occur. The plan's requirement is mandatory, not aspirational (D).
- A company discovers that an employee's laptop containing unencrypted customer data was stolen. Which of the following is the organization's most immediate legal obligation?
Answer: Assess the scope of the data breach and determine applicable breach notification obligations based on the type of data, jurisdiction, and number of affected individuals.
A stolen laptop with unencrypted customer data is likely a reportable breach - the organization must immediately assess what data was on the device and determine applicable notification requirements under state, federal, and international laws. Answer B is correct. Laptop replacement (A) is an operational matter. A police report (C) alone is insufficient. Waiting 30 days (D) would likely violate notification deadlines.
- The primary purpose of the 'eradication' phase of incident response is to:
Answer: Remove the root cause of the incident - including malware, compromised accounts, and attacker persistence mechanisms - from the affected environment.
Eradication focuses on completely removing the attacker's presence and tools from the environment - not just stopping the immediate attack but eliminating all footholds. Answer B is correct. System restoration (A) is the recovery phase. Stakeholder notification (C) occurs during and after containment. Lessons learned (D) are post-incident activities.
- An organization's incident response plan includes a 'containment strategy decision tree.' The primary purpose of this decision tool is to:
Answer: Guide responders in selecting the appropriate containment approach based on the type and severity of the incident, balancing speed of containment against operational impact.
A containment decision tree helps responders quickly determine the right containment strategy for different incident types - balancing the urgency to stop spread against the need to maintain critical operations. Answer D is correct. Regulatory routing (A), cost calculation (B), and root cause identification (C) are separate activities in the IR lifecycle.
