Security+ PBQ 4: Incident Response and GRC

Scenario

A workstation triggers an EDR alert after a user opened a malicious attachment. The SOC must follow the incident response process, preserve evidence, and brief management on risk treatment options.

Your task: Choose the best incident response activity or risk term.

Data Source	Use
Endpoint logs	Process and file activity
Firewall logs	Outbound connections
SIEM dashboard	Correlated alerts

1. Creating playbooks, contacts, and training before an incident is:

2. Reviewing EDR, firewall, and SIEM logs to determine scope is:

3. Isolating the infected workstation from the network is:

4. Removing malware and closing the exploited weakness is:

Evidence and Risk

5. Restoring normal operations after systems are cleaned is:

6. Documenting who collected, handled, and transferred forensic evidence is:

7. SLE multiplied by ARO gives which annual risk value?

8. Buying cyber insurance is an example of which risk strategy?

Instructor Answer

Preparation happens before incidents through playbooks, contacts, and training.
Detection and analysis uses logs and alerts to determine what happened.
Containment limits spread, such as isolating a host.
Eradication removes the cause and closes the weakness.
Recovery restores normal operations.
Chain of custody documents evidence handling.
ALE equals SLE multiplied by ARO.
Insurance is a risk transfer strategy.