An organisation is investigating a security attack on its systems. Which of these must it establish?
The type of attack and the severity level
Why is it important to establish the severity of an attack during the investigation?
It decides the level of response that is needed
A data breach has exposed customers' usernames and passwords. Why should the organisation inform customers quickly?
Customers may use the same details to access other services
An organisation suffers a serious data breach but decides not to report it to the authorities. What is the most likely outcome?
Legal action and possible fines for the organisation
A virus has infected one computer on a company network. Which action manages this attack?
Disconnect the infected computer from the network
What is the main benefit of following the disaster recovery plan after an attack?
The organisation can keep working while remedial action is taken
After systems are restored, which of these is a longer-term remedial action?
Increase the security training given to employees
An organisation has contained a malware attack by disconnecting an infected server. Why should the IT team keep the files on the server instead of deleting them?
It may be needed as evidence for a criminal investigation
A company tells its customers about a data breach. A week later the investigation finds that more customer records were affected. What should the company do?
Send the customers an update with the new information
A company's network is being flooded with unauthorised traffic. Which action would contain this attack?
Block the traffic using a firewall
Which action involves establishing the type and severity of an attack, when it happened, and which processes or services are affected?
Investigate
What is meant by 'manage' as an action taken after an attack?
Isolate the problem by containing the threat as close to its source as possible
What is the name for the action of informing stakeholders, customers and the appropriate authorities, such as the police, once an attack has been discovered?
Respond
What is meant by 'recover' as an action taken after an attack?
Implement the disaster recovery plan and take remedial action so the organisation can carry on working
Which action involves looking back at what went wrong, how it happened and whether it could have been prevented, so that policies and procedures can be improved?
Analyse
What is meant by a 'disaster recovery plan'?
A document that sets out who is responsible for each task, the timeline and the remedial action
We use cookies to enhance your experience. You can manage your preferences or learn more in our Cookie Policy.