I85PREP
⌘ K
PECB ISO/IEC 27035 Foundation Exam Practice & Certification Guide study materials
PECB ISO/IEC 27035 Foundation Exam Practice & Certification Guide study resources

PECB ISO/IEC 27035 Foundation Exam Practice & Certification Guide practice questions

One question at a time. Build your PECB ISO/IEC 27035 Foundation Exam Practice & Certification Guide understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamental principles and concepts of Information Security Incident Management

In ISO/IEC 27035 terminology, what is the primary purpose of the incident management policy?

  1. To document the technical configuration of firewalls
  2. To list every known malware signature that the security team must detect
  3. To define the organization's commitment, direction and principles for managing information security incidents Correct answer.
  4. To replace the need for an incident response team

Explanation

The incident management policy sits at the top of the documentation hierarchy and expresses management commitment, scope, objectives and principles for incident management. It does not contain technical signatures or configuration details, and it enables rather than replaces the incident response team.

Question 2Fundamental principles and concepts of Information Security Incident Management

Which statement best describes the relationship between an 'event' and an 'information security incident' in ISO/IEC 27035?

  1. Events and incidents are synonyms with no distinction in the standard
  2. An incident becomes an event only after root cause analysis is complete
  3. Every incident is an event, but only events that actually or potentially compromise security are incidents Correct answer.
  4. Every event is an incident because any logged activity affects security

Explanation

An event is any observable occurrence in a system or network, while an information security incident is a specific subset of events that actually or potentially threatens information security. The distinction matters because most events are benign and never escalate to incidents.

Question 3Fundamental principles and concepts of Information Security Incident Management

According to ISO/IEC 27035, which set of phases forms the incident management process?

  1. Design; build; test; deploy; retire
  2. Plan and prepare; detection and reporting; assessment and decision; responses; lessons learned Correct answer.
  3. Identify; protect; detect; respond; recover
  4. Prevention; avoidance; transfer; acceptance; review

Explanation

ISO/IEC 27035 structures incident management as plan and prepare, detection and reporting, assessment and decision, responses, and lessons learned (with post-incident activity). The other lists describe risk treatment options or generic system lifecycles, not the incident management process.

Question 4Fundamental principles and concepts of Information Security Incident Management

What is the main purpose of the 'plan and prepare' phase in incident management?

  1. To close the incident ticket after recovery
  2. To collect evidence for legal proceedings
  3. To conduct the forensic analysis of compromised hosts
  4. To establish capabilities, roles, resources and procedures before incidents occur Correct answer.

Explanation

The plan and prepare phase builds the capability to handle incidents, covering policy, roles and responsibilities, the incident response team, tools, communication plans and training. Forensic analysis, evidence collection and ticket closure happen in later phases once an incident has been detected.

Question 5Fundamental principles and concepts of Information Security Incident Management

Which activity belongs to the 'detection and reporting' phase rather than to 'assessment and decision'?

  1. Determining the severity and priority of the reported event
  2. Receiving an alert from monitoring tools and logging it as a potential incident Correct answer.
  3. Deciding whether the reported event is classified as an incident
  4. Assigning the incident to an appropriate response team

Explanation

Detection and reporting covers identifying and reporting potential incidents through monitoring, user reports or automated alerts. Assessment and decision then determines whether the report is an incident and how severe and urgent it is, and assigns ownership.

Question 6Fundamental principles and concepts of Information Security Incident Management

A user reports a suspicious email to the service desk. Under ISO/IEC 27035, what is the most appropriate immediate action?

  1. Delete the email and take no further action because the user did not click
  2. Escalate directly to the board of directors
  3. Publish the sender's address on the corporate intranet
  4. Record the report and route it to the incident assessment process for triage Correct answer.

Explanation

User reports are a valid detection channel, and the report should be captured and passed into assessment so it can be triaged against criteria. Deleting the report loses potential intelligence, while escalating to the board or publicizing details bypasses the defined process.

Question 7Fundamental principles and concepts of Information Security Incident Management

Why does ISO/IEC 27035 emphasize defining incident classification and severity criteria in advance?

  1. To enable consistent, timely triage and prioritization of incidents Correct answer.
  2. To eliminate the need for an incident response team
  3. To guarantee that no incident will ever recur
  4. To satisfy software licensing requirements

Explanation

Predefined classification and severity criteria let responders triage consistently and prioritize the most impactful incidents quickly under pressure. They support decision-making but cannot remove the need for a response team or guarantee that incidents will not recur.

Question 8Fundamental principles and concepts of Information Security Incident Management

Which of the following best describes an Information Security Incident Response Team (ISIRT) as presented in ISO/IEC 27035?

  1. A committee that only approves the annual security budget
  2. An external regulator that audits incident reports
  3. A designated group with defined roles, responsibilities and authority to manage incidents Correct answer.
  4. A software tool that automatically patches vulnerabilities

Explanation

The ISIRT is a designated group of people with clearly assigned roles, responsibilities and the authority to coordinate incident response. It is a human organizational capability, not a tool, regulator or purely financial committee.

Question 9Fundamental principles and concepts of Information Security Incident Management

Why is it good practice to include both technical and non-technical members (for example legal, HR and communications) in the incident response structure?

  1. Because incidents often require legal, contractual, people and communication decisions beyond technical containment Correct answer.
  2. Because non-technical members are responsible for writing malware signatures
  3. Because the standard requires every member to hold a technical certification
  4. Because it removes the need for management approval of the policy

Explanation

Incidents frequently raise legal, contractual, personnel and reputational issues that technical staff cannot resolve alone. Including legal, HR and communications roles ensures these dimensions are addressed alongside technical containment.

Question 10Fundamental principles and concepts of Information Security Incident Management

Which statement about communication during incident response is most consistent with ISO/IEC 27035?

  1. Communication should be improvised to preserve flexibility
  2. Communication plans should define who communicates what, to whom, and when, including internal and external parties Correct answer.
  3. Only the technical team should ever communicate about incidents
  4. All incident details should be shared openly with every employee immediately

Explanation

Effective incident management relies on a predefined communication plan identifying audiences, messages, channels and timing for internal and external stakeholders. Improvised or unrestricted disclosure risks misinformation and legal exposure.

Question 11Fundamental principles and concepts of Information Security Incident Management

In the context of incident management, what does 'containment' aim to achieve?

  1. Restoring all services to full production capacity
  2. Limiting the spread and impact of an incident while response actions are undertaken Correct answer.
  3. Permanently removing the root cause of the incident
  4. Documenting lessons learned for future incidents

Explanation

Containment focuses on stopping the incident from spreading and limiting damage so that further investigation and recovery can proceed. Eradication removes the root cause, recovery restores services, and lessons learned is a post-incident activity.

Question 12Fundamental principles and concepts of Information Security Incident Management

During an incident, a responder wants to shut down a compromised server immediately. What consideration does ISO/IEC 27035 raise about such actions?

  1. Servers should only be shut down after lessons learned is completed
  2. Actions should be balanced against the potential loss of volatile evidence needed for investigation Correct answer.
  3. Shutting down systems is always prohibited during incidents
  4. The decision must be made solely by the communications team

Explanation

Response actions such as shutdown can destroy volatile evidence, so responders must weigh containment needs against the value of preserving evidence. The standard does not prohibit shutdown outright, and such technical decisions are not delegated to communications staff.

Question 13Fundamental principles and concepts of Information Security Incident Management

What is the purpose of the 'lessons learned' phase in ISO/IEC 27035?

  1. To review the incident and response to identify improvements to controls, procedures and training Correct answer.
  2. To calculate the annual security budget
  3. To assign blame to the individual who caused the incident
  4. To archive all logs permanently without review

Explanation

Lessons learned examines what happened and how the response performed, producing recommendations to strengthen controls, procedures and training. Its purpose is organizational improvement, not assigning blame or performing financial planning.

Question 14Fundamental principles and concepts of Information Security Incident Management

Which of the following is the best example of a preventive control that supports incident management by reducing incident likelihood?

  1. A post-incident review meeting
  2. A public relations statement after a breach
  3. An incident ticket tracking system
  4. Regular patching and vulnerability management Correct answer.

Explanation

Patching and vulnerability management reduce the likelihood of incidents by closing exploitable weaknesses. The other options are response, tracking or communication activities that operate after or around incidents rather than preventing them.

Question 15Fundamental principles and concepts of Information Security Incident Management

Why should incident records and evidence be handled with care for potential legal or disciplinary proceedings?

  1. Because legal proceedings require deleting all logs after 24 hours
  2. Because evidence may need to meet rules of admissibility, integrity and chain of custody Correct answer.
  3. Because the standard forbids documenting incidents
  4. Because evidence handling is only relevant to marketing

Explanation

Incidents can lead to legal, regulatory or disciplinary action, so evidence must be collected and preserved in a way that maintains integrity and demonstrable chain of custody. This supports admissibility and credibility if proceedings follow.

Question 16Fundamental principles and concepts of Information Security Incident Management

What distinguishes an 'information security incident' from a 'security weakness' in ISO/IEC 27035 terms?

  1. An incident is a type of software bug, while a weakness is an attack
  2. A weakness is always more severe than an incident
  3. The two terms are interchangeable and require identical responses
  4. A weakness is a vulnerability or flaw, while an incident is an actual or attempted breach of security Correct answer.

Explanation

A weakness (vulnerability) is a flaw that could be exploited, whereas an incident involves an actual or attempted compromise of information security. Weaknesses feed risk management, while incidents trigger the incident management process.

Question 17Fundamental principles and concepts of Information Security Incident Management

An organization detects unusual outbound traffic from a finance workstation. Which action best reflects the 'assessment and decision' phase?

  1. Sending a company-wide email about the event
  2. Evaluating the report against classification criteria to confirm it is an incident and assign severity Correct answer.
  3. Immediately reinstalling the operating system on the workstation
  4. Waiting until the next annual audit to review the event

Explanation

Assessment and decision involves validating whether the reported event is an incident and determining its severity and priority before committing response resources. Reimaging, broad notification or deferring to an audit skip this triage step.

Question 18Fundamental principles and concepts of Information Security Incident Management

Which factor is most relevant when assigning a severity level to an information security incident?

  1. The color scheme used in the incident dashboard
  2. The number of pages in the incident policy
  3. The potential business, legal and operational impact of the incident Correct answer.
  4. The seniority of the person who wrote the monitoring tool

Explanation

Severity reflects the actual or potential impact on business operations, information confidentiality, integrity and availability, and legal or regulatory obligations. Presentation details and authorship of tools do not determine impact.

Question 19Fundamental principles and concepts of Information Security Incident Management

What role does awareness and training play in ISO/IEC 27035 incident management?

  1. It helps staff recognize and report potential incidents promptly and correctly Correct answer.
  2. It transfers legal liability for incidents to individual employees
  3. It removes the need for a formal incident reporting channel
  4. It guarantees that incidents will be detected automatically

Explanation

Awareness and training enable employees to recognize suspicious activity and use the reporting channel correctly, improving detection and response. It complements rather than replaces formal channels and automated detection, and it does not shift legal liability to individuals.

Question 20Fundamental principles and concepts of Information Security Incident Management

Which of the following best explains why incident management should be integrated with business continuity and disaster recovery arrangements?

  1. Because disaster recovery teams write the incident policy
  2. Because continuity plans replace the need to detect incidents
  3. Because major incidents may require continuity and recovery plans to keep critical services operating Correct answer.
  4. Because integration eliminates the need for post-incident reviews

Explanation

Severe incidents can disrupt critical services, so incident response must coordinate with business continuity and disaster recovery to restore operations. Integration supports escalation and recovery; it does not replace detection, policy ownership or post-incident review.

Question 21Fundamental principles and concepts of Information Security Incident Management

An organization wants to measure whether its incident management capability is effective. Which indicator is most meaningful?

  1. The physical size of the security operations room
  2. Trends in incident detection time and time to contain confirmed incidents Correct answer.
  3. The number of employees who have never reported an incident
  4. The total number of security policies printed

Explanation

Meaningful metrics reflect the performance of the process, such as how quickly incidents are detected, assessed and contained, and whether trends improve over time. Counting printed policies or unreported staff does not measure capability.

Question 22Fundamental principles and concepts of Information Security Incident Management

Which statement about the scope of an incident management policy is most accurate?

  1. It should exclude third-party suppliers by default
  2. It should cover only incidents that occur in the data center
  3. It should apply only to the IT department
  4. It should define which assets, locations and personnel the process applies to Correct answer.

Explanation

The policy scope clarifies the assets, organizational units, locations and people covered, so responsibilities and applicability are unambiguous. Narrowing scope to a single facility, department or excluding suppliers by default creates gaps in protection.

Question 23Fundamental principles and concepts of Information Security Incident Management

What is the primary benefit of documenting incident handling procedures in advance?

  1. It removes the need for management support
  2. It guarantees that incidents can never occur again
  3. It allows responders to skip assessment for every incident
  4. Responders can act consistently and quickly under pressure following agreed steps Correct answer.

Explanation

Predefined procedures give responders agreed steps, roles and escalation paths, enabling consistent and rapid action during stressful events. They do not eliminate incidents, replace management support or justify skipping assessment.

Question 24Fundamental principles and concepts of Information Security Incident Management

A phishing email is reported, and analysis shows no one clicked the link. How should this be handled in ISO/IEC 27035 terms?

  1. It may be recorded as a near miss or minor event and used to improve filters and awareness Correct answer.
  2. It should trigger immediate legal action against the sender
  3. It must always be escalated as a critical incident affecting the board
  4. It should be ignored entirely because no compromise occurred

Explanation

Events that could have caused harm but did not are valuable near-miss information for improving preventive controls and awareness. Treating every such report as critical is disproportionate, while ignoring it or pursuing immediate legal action is not the standard's expected handling.

Question 25Fundamental principles and concepts of Information Security Incident Management

Which of the following best describes the relationship between risk management and incident management?

  1. Incident management eliminates the need for risk assessment
  2. Risk management only applies after an incident has been closed
  3. Incident management and risk management are unrelated disciplines
  4. Risk management identifies and treats risks, while incident management handles incidents that materialize from those risks Correct answer.

Explanation

Risk management identifies, assesses and treats risks, and incident management deals with events when those risks materialize despite controls. Lessons from incidents feed back into risk assessment, so the two are complementary rather than substitutes.

Question 26Fundamental principles and concepts of Information Security Incident Management

In ISO/IEC 27035 terms, what is an 'event' as distinct from an 'incident'?

  1. Any confirmed loss of confidentiality, integrity or availability that requires escalation to senior management
  2. A planned change to the configuration baseline that has been approved through change management
  3. A legal obligation to notify a regulator within a fixed number of hours
  4. An occurrence indicating a possible breach of security policy or failure of controls, which may or may not become an incident Correct answer.

Explanation

ISO/IEC 27035 treats an event as an occurrence that indicates a possible information security breach or failure of controls; it only becomes an incident once it is assessed as having actual or potential adverse impact. This two-step distinction is what allows triage to filter noise before scarce response resources are committed.

Question 27Fundamental principles and concepts of Information Security Incident Management

Which sequence best reflects the incident management phases described in ISO/IEC 27035?

  1. Detection, eradication, planning, recovery, audit
  2. Prevention, insurance transfer, disaster declaration, media handling
  3. Plan and prepare, detection and reporting, assessment and decision, responses, lessons learned Correct answer.
  4. Classification, prosecution, remediation, certification

Explanation

ISO/IEC 27035 structures incident management as a lifecycle: planning and preparation, detection and reporting, assessment and decision, responses (including containment, eradication and recovery), and lessons learned. The phases are iterative rather than strictly linear, but this ordering captures the standard's model.

Question 28Fundamental principles and concepts of Information Security Incident Management

What is the primary purpose of the 'plan and prepare' phase in ISO/IEC 27035?

  1. To gather forensic evidence after an incident has been closed
  2. To calculate the annualized loss expectancy of each asset
  3. To notify affected customers of a data breach
  4. To establish policy, roles, resources and procedures before incidents occur so the organization can respond consistently Correct answer.

Explanation

The plan and prepare phase builds the capability itself: policy, an incident management scheme, defined roles, resourcing, procedures and training. Without this groundwork, detection and response depend on improvisation, which produces inconsistent and slower handling.

Question 29Fundamental principles and concepts of Information Security Incident Management

According to ISO/IEC 27035, who should typically be informed first when an incident is detected?

  1. All staff via a company-wide broadcast
  2. The vendor of the affected product, in every case
  3. The external regulator, before any internal assessment
  4. The designated incident response point of contact or team, following the reporting procedure Correct answer.

Explanation

Detection and reporting requires that incidents be reported promptly to a designated point of contact or team so that assessment can begin. Internal reporting precedes any external notification, which depends on the outcome of assessment and legal advice.

Question 30Fundamental principles and concepts of Information Security Incident Management

Which of the following is an example of a detective control relevant to incident management?

  1. A backup restored after data loss
  2. A firewall rule that blocks a port
  3. An encryption key rotation schedule
  4. A security information and event management system that alerts on anomalous logins Correct answer.

Explanation

Detective controls identify and alert on events that have occurred; a SIEM generating alerts on anomalous logins is a classic example. Blocking a port is preventive, while restoring backups is corrective.

Question 31Fundamental principles and concepts of Information Security Incident Management

What does the term 'triage' mean in the context of incident management?

  1. Transferring all incidents to an external provider
  2. Escalating every alert to senior management
  3. Prioritizing and assigning incidents based on assessed severity and impact Correct answer.
  4. Permanently deleting incident records older than one year

Explanation

Triage is the assessment step where incidents are evaluated and prioritized by severity and impact so that response effort goes where it matters most. It is a decision activity that follows detection and reporting.

Question 32Fundamental principles and concepts of Information Security Incident Management

Which document typically authorizes the incident response team to act and defines its mandate?

  1. The asset register
  2. The incident management policy Correct answer.
  3. The network diagram
  4. The business impact analysis report

Explanation

The incident management policy, approved by management, establishes the mandate, scope and authority for incident management. Supporting procedures then describe how the team executes that mandate.

Question 33Fundamental principles and concepts of Information Security Incident Management

Why does ISO/IEC 27035 recommend that incident handling procedures be tested through exercises?

  1. To reveal gaps in roles, communications and tooling before a real incident exposes them Correct answer.
  2. To satisfy insurance requirements only
  3. To replace the need for an incident management policy
  4. To guarantee that no incidents will occur

Explanation

Exercising procedures, for example through tabletop or simulation exercises, exposes weaknesses in roles, communications and tooling while the cost of failure is low. It builds familiarity and confidence that cannot be obtained from reading a document.

Question 34Fundamental principles and concepts of Information Security Incident Management

An analyst receives an alert about a possible malware infection on a laptop. Before declaring a formal incident, what should happen first?

  1. The incident should be reported to the regulator
  2. The laptop should be reimaged immediately and the alert closed
  3. The alert should be assessed to confirm whether it represents a genuine incident and to gauge its impact Correct answer.
  4. The user should be disciplined for the infection

Explanation

Assessment and decision is the phase that determines whether a reported event is a genuine incident and how severe it is. Acting before assessment risks destroying evidence or over-reacting to a false positive.

Question 35Fundamental principles and concepts of Information Security Incident Management

An organization classifies a ransomware outbreak on a file server as high severity. Which response action most directly limits further spread while preserving evidence?

  1. Restore the server from backup before investigating
  2. Announce the breach on social media
  3. Delete all encrypted files to free disk space
  4. Isolate the affected server from the network and preserve its state for investigation Correct answer.

Explanation

Containment aims to stop the incident from spreading, and isolating the host while preserving its state supports both containment and later investigation. Restoring or deleting data before investigation can destroy evidence and allow reinfection.

Question 36Fundamental principles and concepts of Information Security Incident Management

During an incident, the response team must decide whether to inform law enforcement. Which factor is most relevant to that decision?

  1. The nature and legal implications of the incident, guided by legal counsel and policy Correct answer.
  2. The current network bandwidth utilization
  3. The vendor's marketing preferences
  4. The number of staff in the IT department

Explanation

Decisions about law enforcement, regulators and other external parties depend on the nature of the incident and its legal implications, informed by legal counsel and the organization's policy. These decisions are not technical or operational in nature.

Question 37Fundamental principles and concepts of Information Security Incident Management

Which of the following best describes the 'lessons learned' activity in ISO/IEC 27035?

  1. A penetration test performed before an incident occurs
  2. A review after an incident to identify root causes and improvements to controls, procedures and training Correct answer.
  3. A daily stand-up meeting of the IT operations team
  4. A financial audit of the security budget

Explanation

Lessons learned is a post-incident review that examines what happened, why, and what should change in controls, procedures, training and communication. Its output feeds back into the plan and prepare phase to improve future response.

Question 38Fundamental principles and concepts of Information Security Incident Management

Which statement best captures the role of an incident classification scheme?

  1. It guarantees that incidents will not recur
  2. It determines the salary grade of the responder
  3. It assigns a consistent category and severity to incidents so that response and escalation are proportionate Correct answer.
  4. It replaces the need for an incident management policy

Explanation

A classification scheme provides consistent categories and severity levels so that response, escalation and reporting are proportionate and comparable over time. Consistency also supports metrics and trend analysis.

Question 39Fundamental principles and concepts of Information Security Incident Management

What is the main benefit of maintaining an incident register or log?

  1. It eliminates the need for backups
  2. It automatically patches vulnerable systems
  3. It replaces the need for user awareness training
  4. It provides a record for trend analysis, reporting and accountability Correct answer.

Explanation

An incident register records incidents, their classification, actions taken and outcomes, enabling trend analysis, management reporting and accountability. It is a governance and learning tool, not a technical control.

Question 40Fundamental principles and concepts of Information Security Incident Management

A responder discovers that a compromised account was used to access customer data. Which action best reflects the principle of preserving evidence?

  1. Inform the media before internal assessment
  2. Reimage the server without recording its state
  3. Capture and preserve relevant logs and system state in a forensically sound manner Correct answer.
  4. Immediately delete the account and all its logs

Explanation

Preserving evidence means capturing logs and system state in a manner that maintains their integrity and chain of custody. Deleting or reimaging destroys evidence that may be needed for investigation, legal or disciplinary purposes.

Question 41Fundamental principles and concepts of Information Security Incident Management

Which of the following best describes the relationship between an incident and a security weakness in ISO/IEC 27035?

  1. A weakness always results in an incident
  2. A weakness and an incident are identical concepts
  3. An incident is a type of weakness
  4. A weakness is a potential cause that may lead to an incident if exploited or triggered Correct answer.

Explanation

A security weakness is a vulnerability or gap that may be exploited or triggered, potentially causing an incident. Not every weakness leads to an incident, but weaknesses are the underlying conditions that incident management seeks to reduce.

Question 42Fundamental principles and concepts of Information Security Incident Management

Why should incident response roles and responsibilities be defined and documented in advance?

  1. To ensure that during an incident people know who decides, who acts and who communicates Correct answer.
  2. To satisfy auditors without affecting response
  3. To reduce the number of employees required
  4. To avoid the need for any technical controls

Explanation

Defined roles clarify decision authority, action ownership and communication duties so that response is coordinated rather than confused. This is a core element of the plan and prepare phase.

Question 43Fundamental principles and concepts of Information Security Incident Management

An organization experiences a minor incident that is resolved quickly. Why should it still be recorded and reviewed?

  1. Because all incidents must be reported to the regulator
  2. Because recording minor incidents supports trend analysis and may reveal a larger underlying problem Correct answer.
  3. Because recording is only needed for financial incidents
  4. Because minor incidents are exempt from review

Explanation

Even minor incidents can reveal patterns or underlying weaknesses that, if left unaddressed, could escalate. Recording and reviewing them supports trend analysis and continuous improvement.

Question 44Fundamental principles and concepts of Information Security Incident Management

Which of the following best describes the purpose of an incident response plan?

  1. To list every possible attack technique in detail
  2. To serve as a marketing document for customers
  3. To document how the organization will detect, assess, respond to and learn from incidents Correct answer.
  4. To replace the need for risk assessment

Explanation

An incident response plan documents the approach across the lifecycle, from detection and assessment through response and lessons learned. It provides structure and consistency, but it does not replace risk assessment or detailed technical procedures.

Question 45Fundamental principles and concepts of Information Security Incident Management

A company wants to reduce the time between detecting an incident and starting containment. Which measure most directly supports this goal?

  1. Annual financial audits
  2. Increasing the number of servers
  3. Predefined escalation paths and decision criteria for responders Correct answer.
  4. Reducing the number of security staff

Explanation

Predefined escalation paths and decision criteria allow responders to act quickly and consistently without waiting for ad hoc approvals. This shortens the gap between detection and containment.

Question 46Fundamental principles and concepts of Information Security Incident Management

Which of the following situations best illustrates the need for coordination between incident management and human resources?

  1. A server needs a firmware update
  2. A backup schedule is being adjusted
  3. An employee is suspected of deliberately exfiltrating data Correct answer.
  4. A firewall rule is being reviewed

Explanation

Insider incidents involving suspected deliberate wrongdoing require HR involvement for disciplinary process, legal considerations and employee handling. Technical incidents such as firmware updates or firewall reviews do not typically require HR coordination.

Question 47Fundamental principles and concepts of Information Security Incident Management

An incident is assessed as having potential regulatory reporting implications. What should the response team do next according to good practice reflected in ISO/IEC 27035?

  1. Wait until the next annual audit to decide
  2. Engage legal counsel and follow the predefined notification procedure while continuing technical response Correct answer.
  3. Notify the regulator immediately without further assessment
  4. Suppress the incident to avoid reputational damage

Explanation

Where regulatory notification may be required, the organization should engage legal counsel and follow predefined notification procedures in parallel with technical response. Immediate notification without assessment risks inaccuracy, while suppression or delay risks non-compliance.

Question 48Fundamental principles and concepts of Information Security Incident Management

Which of the following best explains why incident management should be aligned with the organization's risk management process?

  1. Because incident management replaces risk treatment
  2. Because incident severity and response priorities should reflect the value of assets and the risks they face Correct answer.
  3. Because risk registers are only used by auditors
  4. Because risk management eliminates the need for incident response

Explanation

Aligning incident management with risk management ensures that severity assessment and response priorities reflect asset value and risk exposure. This alignment also informs which controls and preparations are most worthwhile.

Question 49Fundamental principles and concepts of Information Security Incident Management

A responder finds that an incident's root cause lies in a misconfigured cloud storage bucket. Which output of the lessons learned phase is most valuable here?

  1. A recommendation to update configuration baselines and add automated checks Correct answer.
  2. A public apology issued before investigation completes
  3. A decision to stop using cloud services entirely
  4. A reduction in the incident register's retention period

Explanation

Lessons learned should translate root causes into concrete improvements, such as updated baselines and automated configuration checks that prevent recurrence. Overreaction or premature disclosure does not address the underlying weakness.

Question 50Fundamental principles and concepts of Information Security Incident Management

Which statement best reflects how ISO/IEC 27035 treats communication during an incident?

  1. All technical details should be shared publicly in real time
  2. Communication should follow a planned approach with defined audiences, messages and approval authority Correct answer.
  3. Communication should be avoided until the incident is fully resolved
  4. Communication should be improvised by whoever is available

Explanation

The standard emphasizes planned communication with defined audiences, message approval and coordination, including internal and external stakeholders. Improvisation or blanket silence tends to increase confusion and reputational harm.