Try and practice the latest PECB : ISO-IEC-27035-Lead-Incident-Manager real questions & answers

What is the first step in planning the response to information security incidents?

• A. Developing processes that support the response to information security incidents
• B. Assigning the response class based on incident information
• C. Defining the response classification

What is the primary focus of internal exercises in information security incident management?

• A. Involving external organizations to assess collaboration
• B. Testing inter-organizational communication
• C. Evaluating the readiness of the incident response team

Which of the following statements regarding the principles for digital evidence gathering is correct?

• A. Relevance means that the DEFR should be able to describe the procedures followed and justify the decision to acquire each item based on its value to the investigation
• B. Sufficiency means that only a minimal amount of material should be gathered to avoid unnecessary auditing and justification efforts
• C. Reliability implies that all processes used in handling digital evidence should be unique and not necessarily reproducible

Scenario 7: Located in central London, Konzolo has become a standout innovator in the cryptocurrency field.
By introducing its unique cryptocurrency, Konzolo has contributed to the variety of digital currencies and prioritized enhancing the security and reliability of its offerings.
Konzolo aimed to enhance its systems but faced challenges in monitoring the security of its own and third- party systems. These issues became especially evident during an incident that caused several hours of server downtime This downtime was primarily caused by a third-party service provider that failed to uphold strong security measures, allowing unauthorized access.
In response to this critical situation, Konzolo strengthened its information security infrastructure. The company initiated a comprehensive vulnerability scan of its cryptographic wallet software, a cornerstone of its digital currency offerings The scan revealed a critical vulnerability due to the software using outdated encryption algorithms that are susceptible to decryption by modern methods that posed a significant risk of asset exposure Noah, the IT manager, played a central role in this discovery With careful attention to detail, he documented the vulnerability and communicated the findings to the incident response team and management.
Acknowledging the need for expertise in navigating the complexities of information security incident management. Konzolo welcomed Paulina to the team. After addressing the vulnerability and updating the cryptographic algorithms, they recognized the importance of conducting a thorough investigation to prevent future vulnerabilities. This marked the stage for Paulina s crucial involvement. She performed a detailed forensic analysis of the incident, employing automated and manual methods during the collection phase. Her analysis provided crucial insights into the security breach, enabling Konzolo to understand the depth of the vulnerability and the actions required to mitigate it.
Paulina also played a crucial role in the reporting phase, as her comprehensive approach extended beyond analysis. By defining clear and actionable steps for future prevention and response, she contributed significantly to developing a resilient information security incident management system based on ISO/IEC
27035-1 and 27035-2 guidelines. This strategic initiative marked a significant milestone in Konzolo's quest to strengthen its defenses against cyber threats According to scenario 7, what type of incident has occurred at Konzolo?

• A. Medium severity incident
• B. Critical severity incident
• C. High severity incident

During an ongoing cybersecurity incident investigation, the Incident Management Team (IMT) at a cybersecurity company identifies a pattern similar to recent attacks on other organizations. According to best practices, what actions should the IMT take?

• A. Proactively exchange technical information and incident insights with trusted Incident Response Teams (IRTs) from similar organizations while adhering to predefined information-sharing protocols to improve collective security postures
• B. Focus on internal containment and eradication processes, consulting external experts strictly for legal and public relations management
• C. Delay any external communication until a thorough internal review is conducted, and the impact of the incident is fully understood to prevent any premature information leakage that could affect ongoing mitigation efforts