CCT 237: Practice CISSP Questions - Incident Management (Domain 7)

Send us a text

Wondering how to tackle incident response questions on the CISSP exam? This episode delivers exactly what you need, walking through fifteen essential incident management scenarios that test your understanding of this critical domain.

Sean Gerber breaks down the fundamentals of incident management, exploring how security professionals should approach detection, response, mitigation, and recovery. From distinguishing between legitimate security incidents and routine activities to prioritizing response efforts based on severity, each question targets a specific aspect of incident management that CISSP candidates must master.

The questions systematically cover the incident response lifecycle, highlighting the importance of proper processes rather than blame-focused reactions. You'll learn why activating the incident response team should be your immediate priority upon detection, how to effectively categorize and prioritize incidents, and what constitutes valid mitigation strategies versus ineffective approaches. The episode also emphasizes the documentation requirements for incident reports and the value of capturing lessons learned for continuous improvement.

What makes this episode particularly valuable is how it reinforces the CISSP mindset—understanding not just the technical aspects but the thought processes behind effective security management. Whether you're preparing for certification or looking to strengthen your practical knowledge of incident response, these question scenarios provide the framework you need to approach real-world security events with confidence. Check out the special offer at CISSPCyberTraining.com to continue your certification journey with expert guidance.

Gain exclusive access to 360 FREE CISSP Practice Questions delivered directly to your inbox! Sign up at FreeCISSPQuestions.com and receive 30 expertly crafted practice questions every 15 days for the next 6 months—completely free! Don’t miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success. Join now and start your journey toward CISSP mastery today!

Episode Transcript

Speaker 1 (00:00):
Welcome to the CISSP Cyber Training Podcast, where we
provide you the training andtools you need to pass the CISSP
exam the first time.
Hi, my name is Sean Gerber andI'm your host for this
action-packed, informativepodcast.
Join me each week as I providethe information you need to pass
the CISSP exam and grow yourcybersecurity knowledge.

(00:20):
Alright, let's get started.
Let's go.
Cybersecurity knowledge Allright, let's get started.
Hey y'all, sean Gerber withCISSP Cyber Training.
And today is, wonderfully, it isCISSP Question Thursday.
Yes, we're going to be talkingabout CISSP questions as it
relates to the last episode thatyou had on Monday, which was

(00:41):
7.6.1.
We're talking about incidentresponse processes and this is
going to be covering many ofthose aspects that we had from
the CISSP.
So the goal of this podcast isthis episode is to talk about
the questions themselves andthen kind of go through some
answers and for you to get anunderstanding of what may be
asked of you for the CISSP exam.

(01:02):
Again, wanted to put out thedisclaimer these are not the
CISSP exam.
Again, wanted to put out thedisclaimer these are not the
CISSP questions that you willsee exactly on the test.
They are designed to give youthe understanding of how should
you respond to this test.
That's what's so great aboutthe CISSP certification is that
it isn't just taking a test andpassing the cert.
You actually have to understandthe content and the thought

(01:23):
process behind it so that youcan, one, be a better security
professional, but two, so thatyou can pass the cert.
Now, again, the Sean Gerber ofCISSP Cyber Training.
You can head out to CISSP CyberTraining anytime and get some
great stuff.
I've got awesome stuff outthere for you that you can use.
Got a special going on thismonth that you can go check out.
It's amazing.
And again, make it availablefor you until the end of April.

(01:45):
So it's a very good thing, allright.
So question one which of thefollowing best describes the
purpose of an incidentmanagement in cybersecurity?
So which of the following bestdescribes the purpose of
incident management incybersecurity?
A to prevent all securityincidents from occurring.
B to detect, respond, mitigateand recover from security

(02:08):
incidents effectively.
C to ignore a securityincidence until they become
critical.
Or.
D to blame individualsresponsible for the security
incident.
So which of the following bestdescribes the purpose of
incident management incybersecurity?
And the answer is B to detect,respond, mitigate and recover
from a security eventeffectively.

(02:29):
That's the ultimate goal is tocreate processes and procedures
to do this for an organization.
You want them to be able todetect it, respond, mitigate and
recover in a way that helps thecompany continue operating in a
way that is effective for theirorganization.
So it's again you don't want toblame people I mean, it
probably was Bill's fault forclicking on that link but we
don't want to blame Bill.

(02:50):
We want to resolve the issueand address the problem.
Question two which technology iscommonly used for real-time
monitoring and analysis ofsecurity events and alerts?
So what technology is commonlyused for real-time monitoring
and analysis of security eventsand alerts?
A Intrusion detection systems,b Firewalls, c Antivirus

(03:16):
software or D Virtual privatenetworks.
Again, which technology is usedfor real-time monitoring and
analysis of security events andalerts?
And the answer is A intrusiondetection systems.
Okay, intrusion detection oralso intrusion prevention
systems.
They are used for real-timemonitoring and analysis of
security events and the alertsthat are associated with them.

(03:38):
And now the key on that, though, is they go into a place where
you can actually monitor them.
If they're doing it andnobody's looking at them, it
doesn't really help you a wholelot.
So you want to have the abilityto monitor those systems.
Question three which of thefollowing is not a type of
security incident that can bedetected?
A unauthorized access attempts.
B malware infections, c databreaches or D software updates.

(04:07):
Okay, which of the following isnot a type of security incident
incident that can be detected?
A unauthorized access attemptsbe malware infections or C data
breaches or D software updates.
So which is not a type ofsecurity incident?
That would be a software update.
These are not typicallyconsidered a security incident.
Right, they're rather a routinemaintenance, but the other

(04:29):
three were security incidents.
So one thing is, you want toread through that question too
fast and go oh okay, I'll pickon something real quick.
Now, these all made sense,right, that why you wouldn't do
that.
But you want to read thequestions.
You want to take your time.
You have about about a minutefor each question, so you have
plenty of time to read thequestion and then make a proper
response.

(04:49):
Question four what is theimmediate priority upon
detecting a security incident?
A notify the media.
B activate the incidentresponse team.
C ignore the incident andcontinue on normal operations,
or D delete all logs and coverup the incident?
Probably D, if you are the badperson that did it.
Maybe you might do that, buteven then you should not do that

(05:09):
.
That's a bad idea.
So what is the immediatepriority?
The immediate priority is Bactivate the incident response
team or process.
You want to ensure that that'senabled.
One you need to have one andtwo.
You need to test it, but youneed to activate it once
something happens to ensure thatproper notification is
occurring both internally andexternally.

(05:31):
Question five what does incidentcategorization and
prioritization help with duringthe incident response process?
A ignoring less severeincidents.
B identifying root cause ofincidents.
C prioritizing response.
D delaying response actionsindefinitely.
What does the incidentcategorization and
prioritization help with duringan incident response?

(05:53):
And the answer is Cprioritizing the response
efforts and resource allocations.
So when you deal withprioritization, you're going to
have a lot going on during anincident.
You're going to want toprioritize your efforts and
ensure that the proper resourcesare dedicated to the event, and
that's going to requireallocation of these resources
based on the urgency of theincident.

(06:16):
Question six which of thefollowing is not a mitigation
strategy for addressing securityincidents?
Question six what is it not amitigation strategy for
addressing security incidents?
A ignoring the incident.
Ignoring is never good.
So you know that's probably it,but ignoring and hoping it
resolves itself, that will nothappen.
B isolating the affectedsystems or networks.

(06:39):
C implementing temporary fixesor workarounds.
Or.
D collaborating with externalparties for mitigation efforts.
So the purpose of this questionis one you know.
Obviously it's a very easyanswer ignoring the incident.
That's not a mitigationstrategy.
But the goal of this questionis to highlight the fact that
there are three things you coulddo that to mitigate the issue
Isolate the systems, implementfixes and collaborate with

(07:02):
external parties for mitigationplans.
That is what you want to do.
Question seven what is theprimary purpose of incident
reporting?
Again, what is the primarypurpose of incident reporting?
A to comply with legal andregulatory requirements.
B to blame individualsresponsible for security
incidents.
C to hide information about thesecurity incident to

(07:23):
stakeholders or to delay theresponse actions indefinitely.
What is the primary purpose ofincident reporting?
Now, in this case, this is theprimary purpose, but it isn't
necessarily the primary purposealways, and you may see a
question that would come upwhere it would be really close.
This one here is to comply withlegal and regulatory

(07:43):
requirements.
That is a purpose of anincident report.
If you have to go through it.
Now it may have.
What is the primary purpose ofincident reporting when it
relates to your organization orto, then, the government, then
you want to be very clear whichone it is.
So you're just going to thinkabout.
Don't read through the questionreal quick and go oh my gosh,
that's it, because they couldhave two questions that are very

(08:05):
, very close in nature.
Question eight what shouldincident reports typically
include?
A details about the incidenttimeline, impact analysis,
response actions taken andrecommendations.
B personal opinions about who'sto blame.
C fictional accounts of what'shappened during the incident.
Or D blank pages with noinformation.
Okay, what should incidentreports typically include?

(08:28):
The incident timeline, impactanalysis, response actions taken
and recommendations are all keyfactors that it should be done,
and that would be question A.
These again, these should allbe documented.
They should all be reportedwithin the overall timeline.
Question nine what is theprimary purpose of recovery
efforts in incident management?

(08:50):
To make the incident worse?
A To minimize disruptions ofbusiness operations.
To delete all evidence of theincident.
To deal with the incident in away that is fast and efficient.
So what is the primary purposeof recovery efforts in incident
management?
And that is B to minimizedisruptions of business
operations.
We want to ensure that businessoperations maintain and you

(09:11):
want to have a level of businessresiliency as it relates to an
incident.
Question 10, what is anessential component of
successful incident recovery?
Ensuring that the incident isthere, operational and effective
.
B is deleting the backups andensuring that there is not a
proper recovery.
C regular testing andvalidation of recovery
procedures.

(09:31):
Or D informing the stakeholdersabout the incident.
So what is an essentialcomponent of a successful
incident recovery?
And that successful componentof the recovery would be regular
testing and validation of ofthe recovery procedures.
That would be question C.
Question 11, which of thefollowing is nota long-term

(09:53):
measure for addressing rootcause analysis of an incident?
A patch management andvulnerability remediation.
B configuration changes andsystem hardening.
C blaming individuals forresponsible for the incidents.
Or D lessons learned fromincident response for future
prevention.
So which of the following isnot a long-term measure for
addressing root causes of theincidents?

(10:14):
And that is C blamingindividuals for responsible for
the incident.
That is not a long-term measure.
A long-term measure is patchmanagement.
A long-term measure isconfiguration changes and
gleaning lessons learned fromthe situation.
So question 12, what is thepurpose of documenting lessons
learned from incident response Ato ensure patches are updated.

(10:36):
B to highlight past incidents.
C to provide discoverabledocuments for legal actions.
Or.
D to capture valuable insightsfor continuous improvement.
The purpose of documentinglessons learned is D capturing
valuable insight for continuousimprovement.
You want to make sure that youhave them in place and
operational and that you haveused that, that you've been able

(10:58):
to determine where are some ofthe problems you have and then
how you can fix these problems.
Question 14, during an incidentmanagement, which phase involves
SOC or security operationscenter response to the incident,
considering the severity of thesituation, what actions are
taken during this phase?
So, as you're dealing with theincident response process,

(11:19):
considering the severity of thesituation, what should occur?
A detection, b response, cmitigation or D reporting?
Again, you have a SOC involved.
Now, what action should betaken during this phase?
And it would be B response yoursecurity operations center will
respond to the incident and ifyou don't have one, that may be

(11:41):
something to consider.
But you want to have themrespond and they are done this
through SOAR, which is asecurity orchestration,
automation and response process.
Now this is where an importantfactor comes into and they will
be able to gather evidence, ifour evidence, and be able to
drive the overall plan.
Question 15 which of thefollowing best describes an

(12:02):
iterative nature of incidentmanagement?
A incident management is aone-time activity.
B incident management requirescontinuous monitoring and
improvement.
C incident management should beignored after the first
incident occurs.
Or D incident management isonly necessary for certain types
of security incidents.
So question 15, which of thefollowing best describes the

(12:23):
iterative nature of incidentmanagement?
And the answer is B incidentmanagement requires continuous
monitoring and improvement.
Again, the cybersecuritythreats are always changing and
they are evolving, so it doesrequire this level of continuous
monitoring and improvement.
All right, that's all I havefor you today.
Again, go to CISSP CyberTraining.

(12:44):
You can go check out what I'vegot there.
I've got some great things.
I've got a Valentine's Dayspecial that's going on right
now 30% off my bronze package.
It's available to you.
Go check it out.
It's the lowest price you'llsee this year.
So it's great on that and weare having a wonderful time.
But go out there, check outCISSP Cyber Training and we will

(13:05):
catch you on the flip side.
See ya, bye.