I85PREP
⌘ K
SIRS study materials
SIRS study resources

SIRS practice questions

One question at a time. Build your SIRS understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Incident Response Fundamentals and Frameworks

In the SANS/NIST incident response life cycle, which phase immediately follows 'Identification' and focuses on limiting the scope and impact of a confirmed compromise?

  1. Preparation
  2. Containment Correct answer.
  3. Recovery
  4. Lessons learned

Explanation

The NIST SP 800-61 life cycle moves from preparation into detection and analysis (identification), then containment, eradication, and recovery. Containment is the first response action after an incident is confirmed because it stops further spread before cleanup begins.

Question 2Incident Response Fundamentals and Frameworks

Which document defines the authority, roles, and step-by-step actions a team follows when a specific incident type (for example, ransomware) is confirmed?

  1. Risk register
  2. Business continuity plan
  3. Service level agreement
  4. Incident response playbook Correct answer.

Explanation

A playbook is a prescriptive, incident-type-specific procedure that assigns roles and step-by-step actions once a scenario is confirmed. It operationalizes the broader incident response plan for a particular threat.

Question 3Incident Response Fundamentals and Frameworks

During an incident, a responder preserves a volatile memory image before powering down a server. Which principle does this action best illustrate?

  1. Separation of duties
  2. Order of volatility Correct answer.
  3. Least privilege
  4. Chain of custody

Explanation

The order of volatility says evidence that is most likely to disappear (memory, network state) must be captured before more persistent data such as disk contents. Powering down first would destroy that volatile evidence.

Question 4Incident Response Fundamentals and Frameworks

What is the primary purpose of a tabletop exercise in an incident response program?

  1. To certify analysts on forensic tooling
  2. To validate backup restoration speeds under production load
  3. To rehearse decision-making and coordination against a simulated scenario Correct answer.
  4. To measure mean time to detect in a live environment

Explanation

A tabletop exercise is a discussion-based rehearsal in which participants walk through a scenario to test plans, roles, and communication without touching production systems. It exposes gaps in coordination and decision authority.

Question 5Incident Response Fundamentals and Frameworks

Which team model places a single group with end-to-end responsibility for detecting, analyzing, and responding to incidents across all hours?

  1. Hybrid model
  2. Functional/hierarchical model
  3. Follow-the-sun distributed model Correct answer.
  4. Virtual/ad hoc model

Explanation

A follow-the-sun model distributes one integrated capability across time zones so coverage is continuous and handoffs move with the working day. The same functional team owns the incident end to end.

Question 6Incident Response Fundamentals and Frameworks

An analyst receives an alert, confirms it is a true positive, and assigns it a severity of 'high' based on data sensitivity and number of affected hosts. Which activity has the analyst performed?

  1. Post-incident review
  2. Eradication
  3. Triage Correct answer.
  4. Containment

Explanation

Triage is the act of validating an alert and assigning priority based on impact factors such as data sensitivity and scope. It determines how urgently the incident is handled before response actions begin.

Question 7Incident Response Fundamentals and Frameworks

Which metric best expresses how quickly an organization identifies that an incident has occurred?

  1. Mean time to respond
  2. Mean time to detect Correct answer.
  3. Mean time to recover
  4. Mean time between failures

Explanation

Mean time to detect measures the elapsed time between an incident's onset and its identification. It is a core detection-effectiveness metric used to evaluate monitoring coverage.

Question 8Incident Response Fundamentals and Frameworks

Why does an incident response plan require executive sponsorship and defined communication channels to legal and public relations?

  1. To authorize decisions, manage disclosure obligations, and protect the organization's reputation Correct answer.
  2. To reduce the number of alerts generated by monitoring tools
  3. To satisfy forensic tool licensing requirements
  4. To ensure technical containment steps are executed faster

Explanation

Incidents often involve legal, regulatory, and reputational consequences that technical staff cannot decide alone. Executive sponsorship provides authority and pre-agreed communication paths to legal and communications teams so disclosure and messaging are handled correctly.

Question 9Incident Response Fundamentals and Frameworks

An analyst discovers a compromised workstation and immediately isolates it from the network, but the malware has already spread to two servers. What does this situation best illustrate?

  1. Recovery was achieved prematurely
  2. Eradication preceded containment
  3. Preparation failed because no playbook existed
  4. Containment was initiated but scope identification was incomplete Correct answer.

Explanation

Isolating the first host is a containment action, but the spread to servers shows the scope was not fully understood before or during containment. Effective containment depends on accurate scoping so all affected systems are addressed.

Question 10Incident Response Fundamentals and Frameworks

A responder needs to collect evidence from a running system that may later support legal action. Which action best preserves admissibility?

  1. Reboot the system to clear malware from memory before imaging
  2. Allow the system owner to review and modify the image before archiving
  3. Document each collection step, hash the evidence, and maintain an unbroken chain of custody Correct answer.
  4. Copy only the files the analyst believes are relevant to save time

Explanation

Admissibility depends on demonstrating that evidence was not altered, which requires documented collection, cryptographic hashing, and an unbroken chain of custody. Selective or modified collection undermines that integrity.

Question 11Incident Response Fundamentals and Frameworks

During an active intrusion, the incident commander decides to block outbound traffic to a known command-and-control domain at the perimeter. Which response objective does this primarily serve?

  1. Containment of adversary control channels Correct answer.
  2. Recovery of affected services
  3. Eradication of the malware from endpoints
  4. Root cause analysis

Explanation

Blocking command-and-control communication limits the adversary's ability to direct and exfiltrate from compromised hosts, which is a containment objective. Eradication and recovery come later once control is established.

Question 12Incident Response Fundamentals and Frameworks

An organization's incident response plan states that the security team may take systems offline during an incident. What critical gap should be evaluated regarding this authority?

  1. Whether the security team has the tooling to image disks
  2. Whether the plan references a specific threat intelligence feed
  3. Whether business owners have agreed on acceptable downtime and approval thresholds Correct answer.
  4. Whether analysts have completed forensic certification

Explanation

Authority to take systems offline can conflict with business continuity, so the plan must define downtime tolerance and who approves disruptive containment. Without agreed thresholds, responders may cause avoidable business harm or hesitate during an incident.

Question 13Incident Response Fundamentals and Frameworks

A CSIRT uses a tiered model where Tier 1 monitors and triages alerts, Tier 2 investigates, and Tier 3 performs advanced forensics. What is a primary risk of this structure?

  1. Excessive false positives reaching Tier 3
  2. Loss of context during escalation between tiers Correct answer.
  3. Overreliance on a single generalist analyst
  4. Inability to operate outside business hours

Explanation

Tiered models create handoffs, and context can degrade as an incident moves from one tier to the next. Clear escalation documentation and shared case records are needed to preserve investigative detail.

Question 14Incident Response Fundamentals and Frameworks

An analyst finds a suspicious scheduled task on a server and wants to determine whether it is malicious before removing it. Which action is most appropriate at this stage?

  1. Rebuild the server from a known-good image
  2. Collect the task definition, associated binaries, and execution logs for analysis Correct answer.
  3. Delete the task immediately to prevent execution
  4. Notify the media about a potential breach

Explanation

Before eradication, responders must confirm maliciousness and understand persistence so removal is complete and scope is known. Collecting the task definition, binaries, and logs provides that evidence without destroying it.

Question 15Incident Response Fundamentals and Frameworks

Which statement best distinguishes an 'event' from an 'incident' in incident response terminology?

  1. An event is any observable occurrence, while an incident is an event that actually or potentially harms the organization Correct answer.
  2. An incident is any logged occurrence, while an event is a confirmed breach
  3. Events are recorded only by network sensors, while incidents are recorded only by host sensors
  4. An event always involves malware, while an incident involves only policy violations

Explanation

An event is any observable occurrence in a system or network, most of which are benign. An incident is a subset of events that has confirmed or suspected negative impact, which is why not every event warrants incident handling.

Question 16Incident Response Fundamentals and Frameworks

A company experiences a breach and later documents that the attacker entered through an unpatched VPN appliance, then lists corrective actions. Which phase of the life cycle does this documentation belong to?

  1. Preparation
  2. Detection and analysis
  3. Containment, eradication, and recovery
  4. Post-incident activity Correct answer.

Explanation

Post-incident activity captures root cause, timeline, and corrective actions after the incident is resolved so future response improves. Identifying the entry vector and assigning remediation here is the lessons-learned function.

Question 17Incident Response Fundamentals and Frameworks

Why should an incident response plan be tested through technical simulations in addition to tabletop exercises?

  1. Technical simulations eliminate the need for a written plan
  2. Tabletop exercises are only useful for executives
  3. Tabletop exercises cannot cover communication roles
  4. Technical simulations reveal tooling and process failures that discussion alone cannot expose Correct answer.

Explanation

Tabletops test decisions and coordination, but only hands-on simulations exercise actual tooling, data flows, and technical procedures where failures surface. Combining both gives coverage of people and technology.

Question 18Incident Response Fundamentals and Frameworks

A responder must decide whether to shut down a compromised server or keep it running to monitor attacker activity. Which factor is most relevant to this decision?

  1. The server's physical location in the data center
  2. The operating system version installed
  3. The value of continued monitoring versus the risk of further damage or data loss Correct answer.
  4. The number of analysts on shift

Explanation

The tradeoff is between intelligence gained from observing the adversary and the risk of ongoing harm, such as data destruction or lateral movement. That balance, informed by business impact, drives the containment decision.

Question 19Incident Response Fundamentals and Frameworks

Which activity is part of eradication rather than recovery?

  1. Re-enabling network access for users
  2. Restoring a server from a clean backup
  3. Monitoring restored systems for normal operation
  4. Removing malicious accounts and deleting identified malware from affected hosts Correct answer.

Explanation

Eradication eliminates the threat itself, such as malware, attacker accounts, and persistence, from the environment. Recovery then restores and validates normal operations.

Question 20Incident Response Fundamentals and Frameworks

An incident response team outsources forensic analysis but keeps triage and containment in-house. Which team model does this describe?

  1. Follow-the-sun model
  2. Fully outsourced model
  3. Functional tiered model
  4. Hybrid model Correct answer.

Explanation

A hybrid model combines internal capabilities with external specialists for selected functions such as deep forensics. It is common when certain skills are needed only occasionally.

Question 21Incident Response Fundamentals and Frameworks

An analyst is asked to determine whether a reported phishing email represents a widespread campaign requiring incident response or an isolated user report. Which analytical step is most directly relevant?

  1. Assigning the incident a severity before checking scope
  2. Calculating the mean time to recover
  3. Scoping by searching mail logs and gateway data for similar messages Correct answer.
  4. Reviewing the chain of custody for the email file

Explanation

Scoping establishes how many users and systems received the message, which determines whether this is an isolated event or a campaign. That evidence drives severity and the appropriate response.

Question 22Incident Response Fundamentals and Frameworks

An organization wants to reduce the likelihood that a single compromised administrator account can destroy forensic evidence. Which control best addresses this risk?

  1. Centralized, append-only logging with separate retention controls Correct answer.
  2. Storing all logs only on the monitored host
  3. Disabling logging during incident response to avoid noise
  4. Granting administrators full control over log servers

Explanation

Centralized, append-only log storage with separate access controls prevents an attacker with host or admin privileges from erasing evidence. It preserves the integrity of the investigative record.

Question 23Incident Response Fundamentals and Frameworks

A responder identifies a compromised host but cannot determine whether lateral movement occurred. Which course of action is most consistent with sound incident response practice?

  1. Close the incident as contained because only one host is confirmed
  2. Delete all logs to prevent the attacker from learning the investigation is underway
  3. Treat the environment as potentially compromised and hunt for additional indicators before declaring containment Correct answer.
  4. Immediately restore the host from backup and return it to service

Explanation

When scope is uncertain, responders should assume broader compromise and hunt for related indicators before declaring containment. Premature closure risks leaving the adversary active elsewhere.

Question 24Incident Response Fundamentals and Frameworks

Which pairing of incident response phase and primary output is most accurate?

  1. Recovery: attacker accounts removed from the directory
  2. Post-incident activity: containment of the command-and-control channel
  3. Detection and analysis: validated incident with known scope and severity Correct answer.
  4. Preparation: documented root cause of the last incident

Explanation

Detection and analysis concludes with a validated incident whose scope and severity are understood well enough to drive response. Each phase should produce a defined output that feeds the next.

Question 25Incident Response Fundamentals and Frameworks

An incident commander must decide whether to notify regulators about a breach before technical scope is fully known. Which consideration most directly shapes this decision?

  1. The number of analysts assigned to the case
  2. The availability of a threat intelligence feed
  3. Statutory or contractual notification deadlines and the organization's legal obligations Correct answer.
  4. The operating system of the affected hosts

Explanation

Notification decisions are governed by legal and contractual deadlines that may require disclosure before full technical certainty. Legal counsel should be engaged early to balance compliance with investigative needs.

Question 26Incident Response Fundamentals and Frameworks

Which phase of the incident response lifecycle is primarily concerned with removing the root cause of an intrusion and closing the initial access vector so the adversary cannot simply re-enter?

  1. Preparation
  2. Recovery
  3. Eradication Correct answer.
  4. Detection and analysis

Explanation

Eradication focuses on eliminating the malicious artifacts and the underlying vulnerability or access path that allowed the intrusion, so the attacker cannot regain a foothold. Recovery instead restores normal operations, while preparation and detection are earlier lifecycle stages.

Question 27Incident Response Fundamentals and Frameworks

According to the NIST SP 800-61 incident response lifecycle, which activity belongs to the 'containment, eradication, and recovery' phase rather than to 'detection and analysis'?

  1. Validating that an alert represents a genuine security incident
  2. Documenting the incident-handling plan approval process
  3. Applying a short-term mitigation such as segmenting an affected subnet Correct answer.
  4. Establishing a baseline of normal network traffic for future comparison

Explanation

Containment actions limit the spread of an incident, and segmenting an affected subnet is a classic short-term containment measure within that phase. Validation of alerts belongs to detection and analysis, while baselining and plan approval are preparation activities.

Question 28Incident Response Fundamentals and Frameworks

A responder is documenting the sequence of an intrusion for a post-incident review. Which record best captures the 'who, what, when' needed to reconstruct the timeline and support lessons learned?

  1. A chronological incident log with timestamps, actors, and actions taken Correct answer.
  2. A screenshot of the antivirus console showing the quarantine action
  3. A copy of the final malware sample hash list
  4. A summary email sent to the CIO after closure

Explanation

A timestamped, chronological log recording who did what and when is the primary artifact for reconstructing events and driving lessons learned. Screenshots, hash lists, and closure emails are supporting evidence but do not provide the ordered narrative needed for review.

Question 29Incident Response Fundamentals and Frameworks

An organization adopts the SANS six-step incident response process. Which step immediately follows 'identification' in that model?

  1. Preparation
  2. Eradication
  3. Lessons learned
  4. Containment Correct answer.

Explanation

In the SANS process the sequence is preparation, identification, containment, eradication, recovery, and lessons learned. Containment therefore directly follows identification, before eradication and recovery.

Question 30Incident Response Fundamentals and Frameworks

A CSIRT is drafting its charter and must decide how authority is distributed during a major incident. Which arrangement best reflects accepted incident command principles for a multi-team response?

  1. Each technical team lead independently decides containment actions within their own domain
  2. A single designated incident commander sets priorities and approves major containment decisions Correct answer.
  3. The most senior engineer present automatically assumes decision authority regardless of role
  4. Authority rotates every hour among team leads to distribute decision fatigue

Explanation

Incident command principles call for a clearly designated incident commander who maintains a single point of decision authority and sets priorities across teams. Distributed or rotating authority produces conflicting actions and unclear accountability during fast-moving events.

Question 31Incident Response Preparation and Planning

An organization is drafting its first incident response policy. Which statement best describes the purpose of the preparation phase within the incident response lifecycle?

  1. Documenting lessons learned in a post-incident review meeting
  2. Determining the root cause of an incident after containment has been completed
  3. Establishing capabilities, resources, and procedures before an incident occurs so the team can respond effectively Correct answer.
  4. Restoring affected systems to normal operation once eradication is finished

Explanation

Preparation is the phase in which an organization builds the people, processes, and technology needed to handle incidents before they happen. It covers policy, plans, team structure, tooling, and training rather than post-event activities. Root cause analysis, restoration, and lessons learned belong to later lifecycle phases.

Question 32Incident Response Preparation and Planning

A security manager is assembling a cross-functional incident response team. Which combination of roles most directly supports both technical containment and business decision-making during an incident?

  1. A legal counsel and a public relations officer only
  2. A help desk technician and a payroll administrator
  3. A technical lead for containment and a management sponsor authorized to make business decisions Correct answer.
  4. An external penetration tester and a software vendor

Explanation

Effective incident response requires both hands-on technical capability to contain and investigate, and management authority to approve disruptive actions and communicate with stakeholders. Pairing a technical lead with an empowered management sponsor covers both needs. Other combinations lack either the technical or decision-making authority.

Question 33Incident Response Preparation and Planning

Which document typically defines the authority, scope, and high-level requirements for how an organization will respond to security incidents?

  1. The incident response policy Correct answer.
  2. The incident response plan
  3. The incident response procedure
  4. The incident response playbook

Explanation

A policy is the highest-level document and states management's intent, scope, and authority for incident response. Plans, procedures, and playbooks implement the policy at increasing levels of operational detail. This hierarchy is a standard governance concept in incident response preparation.

Question 34Incident Response Preparation and Planning

An organization wants to ensure its incident response plan remains usable after key staff departures. Which preparation activity most directly addresses this risk?

  1. Waiting until an incident occurs to identify who is available
  2. Restricting plan access to a single senior manager
  3. Storing the plan only on the personal laptop of the team lead
  4. Maintaining documented contact lists and cross-training personnel on response roles Correct answer.

Explanation

Preparedness depends on documented, current contact information and on multiple people being trained to fill critical roles. Cross-training and maintained rosters reduce dependence on any single individual. Restricting access or relying on ad hoc staffing undermines response capability.

Question 35Incident Response Preparation and Planning

Which activity is a core element of an incident response training and awareness program for general employees?

  1. Requiring all staff to lead tabletop exercises
  2. Having employees write their own incident response policy
  3. Training every employee to perform forensic disk imaging
  4. Teaching employees how to identify and report suspected security incidents through defined channels Correct answer.

Explanation

General awareness training focuses on recognition and reporting so incidents are detected early and escalated properly. Specialized forensic and exercise-leadership skills belong to the dedicated response team. Policy authorship is a governance function, not an awareness activity.

Question 36Incident Response Preparation and Planning

During preparation, an organization classifies incidents by severity to prioritize response. Which factor is most appropriate to include in a severity classification scheme?

  1. The potential business impact and scope of affected systems or data Correct answer.
  2. The physical office location of the responding analyst
  3. The brand of firewall deployed at the network perimeter
  4. The number of years each responder has worked in IT

Explanation

Severity classification should reflect business impact, such as affected data sensitivity, number of systems, and operational disruption. These factors drive escalation and resource allocation. Responder tenure, analyst location, and vendor brand do not measure incident severity.

Question 37Incident Response Preparation and Planning

An incident response team maintains a jump kit or go-bag. Which item is most useful to include for on-site response?

  1. Marketing brochures for the organization
  2. A personal smartphone belonging to the CEO
  3. A spare office chair
  4. Forensic tools, blank media, and documentation templates Correct answer.

Explanation

A jump kit contains tools and supplies responders need to collect evidence and document actions at a scene, such as forensic utilities, write-blocked media, and forms. These items support evidence integrity and efficient response. Office furniture, marketing material, and personal devices are irrelevant.

Question 38Incident Response Preparation and Planning

Which preparation step best ensures that incident response communications reach the right people quickly during a crisis?

  1. Limiting communications to a single email distribution list that no one monitors
  2. Relying on employees to discover the escalation path during the incident
  3. Predefining escalation paths and maintaining an up-to-date call tree or notification system Correct answer.
  4. Publishing the incident response plan only on the intranet homepage without notifications

Explanation

Predefined escalation paths and tested notification mechanisms ensure the right people are alerted promptly when an incident is declared. This is a documented preparation activity in incident response planning. Ad hoc discovery or unmonitored channels cause delays.

Question 39Incident Response Preparation and Planning

An organization wants to test its incident response plan in a low-risk setting before a real event. Which activity is designed to walk participants through a simulated scenario and identify gaps without disrupting production systems?

  1. A penetration test of the production network
  2. A tabletop exercise Correct answer.
  3. A scheduled production database migration
  4. A full-scale live failover of production systems

Explanation

A tabletop exercise is a discussion-based simulation where participants talk through a scenario and their roles, revealing gaps without touching live systems. It is a standard preparation and validation activity. Live failovers, penetration tests, and migrations carry production risk or serve different purposes.

Question 40Incident Response Preparation and Planning

An incident response plan defines the roles of the incident commander, communications lead, and technical lead. During an actual incident, a responder is unsure who has authority to take a critical system offline. Which preparation element should have resolved this ambiguity?

  1. A clear delegation of authority and decision rights documented in the plan Correct answer.
  2. The most senior person present making an unreviewed decision
  3. A verbal understanding reached during the incident
  4. A note in the marketing department's style guide

Explanation

Preparation should document decision rights and delegation of authority so responders know who can approve disruptive actions like isolating systems. This prevents delay and confusion during high-pressure events. Verbal or ad hoc decisions undermine consistency and accountability.

Question 41Incident Response Preparation and Planning

A small organization cannot staff a 24x7 internal incident response team. Which preparation approach best maintains coverage?

  1. Disabling all logging to reduce noise until staff are available
  2. Assuming incidents only occur during business hours
  3. Requiring all employees to monitor alerts around the clock without compensation
  4. Establishing an on-call rotation supplemented by an outsourced incident response retainer Correct answer.

Explanation

An on-call rotation combined with an external retainer provides continuous coverage when internal staffing is limited. This is a recognized way to scale response capability for smaller organizations. Disabling logging or assuming business-hours-only incidents leaves the organization exposed.

Question 42Incident Response Preparation and Planning

During preparation, an organization maps its critical assets and data flows. How does this activity most improve incident response readiness?

  1. It permanently eliminates the need for any incident response plan
  2. It helps responders prioritize protection and containment based on business criticality Correct answer.
  3. It guarantees that no incident will ever affect those assets
  4. It replaces the need for logging and monitoring

Explanation

Asset and data-flow mapping tells responders which systems and data matter most, enabling prioritized containment and recovery. This knowledge is a foundational preparation activity in incident response planning. It does not prevent incidents or substitute for detection controls.

Question 43Incident Response Preparation and Planning

An organization is selecting tools for incident response preparation. Which capability is most important for enabling timely detection and investigation of incidents?

  1. A larger break room for responders
  2. A social media monitoring dashboard for marketing
  3. Centralized logging with adequate retention and search capability Correct answer.
  4. A new payroll processing system

Explanation

Centralized logging with sufficient retention and searchability is essential for detecting, scoping, and investigating incidents. It provides the evidence trail responders rely on. The other options do not contribute to incident detection or investigation.

Question 44Incident Response Preparation and Planning

Which preparation activity best ensures that evidence collected during an incident will be admissible and defensible in a legal proceeding?

  1. Establishing chain-of-custody procedures and using forensic tools that preserve integrity Correct answer.
  2. Relying on memory rather than written documentation
  3. Allowing responders to modify evidence freely for convenience
  4. Deleting logs after each shift to save storage

Explanation

Chain-of-custody documentation and integrity-preserving forensic practices are prerequisites for defensible evidence. These must be defined during preparation so responders follow them consistently. Modifying, deleting, or failing to document evidence undermines its value.

Question 45Incident Response Preparation and Planning

An organization conducts a post-incident review after a major event. How does this activity relate to the preparation phase?

  1. Its findings should feed back into updating plans, training, and tooling for future readiness Correct answer.
  2. It has no relationship to preparation and is purely administrative
  3. It is performed only to assign blame to individuals
  4. It replaces the need for any future preparation activities

Explanation

Lessons learned from post-incident reviews should be incorporated into plans, procedures, training, and tooling, closing the loop back to preparation. This continuous improvement cycle is a core principle of incident response management. Reviews are not blame exercises and do not eliminate future preparation.

Question 46Incident Response Preparation and Planning

A multinational organization must prepare for incidents that may trigger legal notification obligations in multiple jurisdictions. Which preparation element is most important?

  1. Assuming one jurisdiction's rules apply everywhere
  2. Pre-identifying legal counsel and regulatory notification requirements for each jurisdiction Correct answer.
  3. Avoiding any communication with legal counsel to reduce costs
  4. Waiting until an incident occurs to research applicable laws

Explanation

Preparation should identify legal counsel and the breach notification requirements for each jurisdiction so obligations can be met within mandated timelines. Researching laws mid-incident risks missed deadlines and penalties. Assuming uniformity across jurisdictions is a common and costly error.

Question 47Incident Response Preparation and Planning

Which metric is most useful during preparation to evaluate whether an organization can detect incidents quickly?

  1. The number of employees in the marketing department
  2. The total number of office supplies ordered
  3. The number of years since the last policy revision only
  4. The mean time to detect (MTTD) measured during simulations or monitoring reviews Correct answer.

Explanation

Mean time to detect is a key performance indicator of detection capability and can be assessed through simulations and monitoring reviews. It directly measures how quickly incidents are noticed. The other options are unrelated to detection performance.

Question 48Incident Response Preparation and Planning

An organization prepares a playbook for ransomware incidents. What distinguishes a playbook from the broader incident response plan?

  1. A playbook is only used after an incident is fully resolved
  2. A playbook replaces the need for any policy or plan
  3. A playbook provides detailed, scenario-specific steps while the plan covers overall strategy and structure Correct answer.
  4. A playbook contains no operational guidance

Explanation

Playbooks give tactical, scenario-specific procedures, such as steps for ransomware containment and recovery, while the plan defines overall strategy, roles, and governance. Playbooks complement rather than replace the plan. They are used during active response, not only afterward.

Question 49Incident Response Preparation and Planning

During preparation, an organization decides which incidents must be escalated to executive management. Which criterion is most appropriate for triggering executive escalation?

  1. Incidents that occur outside standard business hours
  2. Any alert generated by a routine antivirus scan
  3. Incidents with potential for significant business, legal, or reputational impact Correct answer.
  4. Only incidents reported by the IT director personally

Explanation

Executive escalation should be tied to potential material impact such as business disruption, legal exposure, or reputational harm. This ensures leadership is engaged when decisions and resources are needed. Routine alerts or time-of-day alone are poor escalation criteria.

Question 50Incident Response Preparation and Planning

An organization wants to validate that its incident response plan works end-to-end, including technical containment and recovery. Which exercise type best meets this goal?

  1. A discussion-only tabletop exercise
  2. Reviewing only the policy document
  3. A full-scale simulation involving technical teams and production-like systems Correct answer.
  4. Reading the plan silently in a meeting

Explanation

A full-scale simulation exercises the plan end-to-end, including technical containment, communication, and recovery steps, revealing integration issues that discussion-based exercises cannot. Tabletop exercises and document reviews validate understanding but not technical execution. This makes full-scale simulation the best fit for the stated goal.