Incident reporting and communication

Key: B

1. AAn internal messaging system may share the same identity provider or infrastructure as the compromised email, so the attacker could still be watching.
2. BCorrect: An out-of-band channel runs separately from the possibly compromised systems, so responders can coordinate without the attacker seeing their plans.
3. CCompany social media is public and is the wrong place for confidential incident coordination.
4. DUsing the compromised email system lets the attacker read the response plan as it is being made.

Key: B

1. ASoftware vendors may help with a product flaw, but they cannot investigate a crime.
2. BCorrect: Law enforcement has the authority to investigate criminal acts such as data theft and can advise on evidence handling for possible prosecution.
3. CIndustry analysts study markets; telling them about a live incident would be an uncontrolled disclosure.
4. DCompetitors have no role in the response, and telling them would leak sensitive information.

Key: C

1. AKeeping the incident quiet does not speed up eradication; the problem is a communication failure, not skipped root-cause analysis.
2. BPlaybooks do not require public relations for every incident, and stakeholder notification is about internal decision-makers instead of outside PR.
3. CCorrect: Playbooks require timely escalation to business stakeholders during the incident so leaders can make risk decisions; waiting until patching is finished breaks that requirement.
4. DSecrecy has nothing to do with choosing between forensic preservation and containment; the issue is withholding information from stakeholders.

Key: B

1. AIn a Business Email Compromise the corporate email system is the compromised channel, so even encrypted messages there can reveal the response to the attacker.
2. BCorrect: An approved out-of-band secure messaging app keeps the attacker from watching containment plans and still keeps an auditable organizational record of communications.
3. CNew personal webmail accounts are unmanaged and outside the organization's records, so they break chain-of-custody and governance.
4. DUnencrypted SMS on personal devices is insecure and creates no reliable organizational record.

Key: C

1. APersonal unapproved email is not a better option; it lacks governance and record-keeping and does not address the attacker's access.
2. BWhether a ticketing tool accepts forensic images is a minor tooling detail and far from the operational risk in this scenario.
3. CCorrect: A global administrator account can usually read enterprise tools, so the attacker may watch the ticketing system and see containment plans before they happen.
4. DTicketing systems do not automatically lock out responders; the risk is that the attacker can see what they write there.

Key: D

1. AIssuing a press release first, before legal review, risks inaccurate or damaging statements and conflicts with notification requirements.
2. BA press release should never come before legal review, and contacting law enforcement first without counsel skips coordination.
3. CNotifying customers before consulting counsel puts legal review last, when it should shape every external message.
4. DCorrect: Counsel is consulted first, PR then prepares a reviewed statement, and regulators are notified as the law requires, all before a public press release.

Key: B

1. AHigh severity is for compromise of critical business systems; an isolated development workstation without sensitive data does not meet that bar.
2. BCorrect: An isolated system with no sensitive data matches the Low row of the matrix, so the escalation path is the local SOC supervisor.
3. CMedium severity requires a non-critical system that holds sensitive data, and nothing in the scenario says the workstation holds any.
4. DThis over-escalates and also uses an escalation path that is not in the matrix.

Key: C

1. ADiscovery commands on one workstation are early, low-confidence activity that the SOC can handle without executives.
2. BA single failed logon is routine noise and would flood executives with false alarms.
3. CCorrect: Confirmed persistence plus data staging shows the attacker is established and preparing to exfiltrate, which is the kind of imminent business impact that warrants executive escalation.
4. DOne DNS query to a known domain is a single indicator that needs triage and falls well below an executive-level threshold.

Key: A

1. ACorrect: Measurable criteria such as data volume and number of affected assets let analysts apply escalation the same way every time, instead of guessing what might be regulatory.
2. BQualitative descriptions alone keep the ambiguity the policy is trying to remove.
3. CEscalating every malware detection to executives creates alert fatigue and ignores actual impact.
4. DEscalating based on a manager's feeling is subjective and cannot be applied consistently.

Key: A

1. ACorrect: Timestamps and session correlation IDs are what let analysts order events and link related activity, so masking them makes timeline analysis impossible.
2. BTruncated payload strings limit analysis of the exploit itself but do not stop the firm from ordering and linking events.
3. CGeneric tags in place of hostnames still let events be linked as long as each tag is used consistently.
4. DConsistent random tokens hide user identities but still let related events be linked to the same account.

Key: A

1. ACorrect: Consistent tokens hide the identities but keep the link that the same user did both the login and the export, which behavioral analysis needs.
2. BReplacing every identifier with the same null value protects privacy but destroys the ability to link actions to a user.
3. CGiving the same person two different tokens breaks the relationship between the login and the export.
4. DKeeping real names exposes personal information to the vendor.

Key: D

1. AContainment is already finished; a longer root-cause analysis does not undo it.
2. BNotification laws do not require releasing plaintext copies of exposed records.
3. CEvidence preservation is a separate duty and does not depend on when notifications are sent.
4. DCorrect: The 60-day clock starts at discovery on June 1, so waiting for a root-cause analysis due August 15 misses the deadline.

Key: C

1. AFollowing the most lenient timeline violates the stricter frameworks that also apply.
2. BStaggered, inconsistent notices can still miss the strictest deadline and create conflicting public statements.
3. CCorrect: Writing notices that meet the strictest timing and content requirements satisfies every framework at once and keeps the messages consistent.
4. DRegulators do not require plaintext samples of exposed records, and including them would cause more exposure.

Key: C

1. AA timeline records what happened but does not track whether fixes are completed.
2. BNotes without deadlines or validation give no way to enforce or confirm closure.
3. CCorrect: Each action item needs an owner, a deadline, and regular status updates so lessons learned turn into completed fixes.
4. DA list of gaps without owners leaves no one accountable, so items tend to stay open.

Key: C

1. ASkipping peer review on informational alerts is a quality problem, but those alerts carry little risk, so it does not show why the metric hides real risk.
2. BMore false positives inflate the workload but would usually make closure easier, so they would not hide open high-risk items.
3. CCorrect: If the 1 percent left open are all critical alerts, a 99 percent closure rate looks excellent while the most dangerous issues remain unresolved.
4. DAutomating routine malware remediation is a legitimate efficiency gain and no sign the metric is misleading.

Key: C

1. AMean time to detect measures speed and cannot explain why the raw number of alerts changed.
2. BATT&CK categories describe what kind of alerts fired but do not explain an overall increase in volume.
3. CCorrect: If many new assets were added, more alerts are expected, so raw counts must be normalized, for example alerts per 1,000 assets, before they mean anything.
4. DTime to contain is a response metric and does not explain why alert volume grew.

Key: A

1. ACorrect: Executives need the business impact first, then scope and risk, the decisions or actions asked of them, and current status, without technical detail.
2. BTechnical root cause and endpoint lists are too detailed for leadership, and budget out of context does not tell them what is at stake.
3. CExploit mechanics and team schedules are operational details that do not belong on a one-page executive brief.
4. DRaw event logs and network maps are technical artifacts that executives cannot use to make decisions.