6 Incident Response Online Quiz Questions

True

False

True

False

Wait for an incident before deciding who has authority to declare one.

Assign roles, decision-making authority, escalation paths, and backup contacts in advance.

Leave reporting procedures undefined so responders can choose a process during the incident.

Give all incident decisions to the security team, regardless of the issue or organizational role.

Return every affected service to normal use at once, then investigate any remaining weaknesses.

Restore systems from any available backup and check only whether users can log in.

Restore from known-good sources, address weaknesses, and test systems before returning them to normal use.

Keep all affected services offline until every after-action improvement has been completed.

Isolate an affected device from the network.

Rotate exposed credentials and keys to remove unauthorized access.

Disable or restrict a suspected compromised account.

Block malicious network traffic.

Define what counts as an incident and how suspected incidents should be reported.

Assign roles, decision-making authority, escalation paths, and backup contacts.

Assume the same reporting rule applies to every incident, without consulting relevant specialists.

Test the response plan and ensure recovery resources, such as verified backups, are available.

Treat the alert as a confirmed incident and immediately restore all systems from backup.

Assess whether the alert is credible, whether it meets incident criteria, and what action is needed first.

Delete the alert if it has not yet been corroborated by a user report.

Begin eradication by removing any suspicious file before identifying affected systems.

Delay all protective action until every possible source of evidence has been collected.

Avoid documenting the action so the team can act more quickly.

Take urgent steps to protect people or limit serious harm, while preserving evidence where possible and recording what changed and why.

Wipe the affected system immediately, regardless of the threat or operational impact.

Wait until every recovery task is complete before sharing any useful lesson.

Assign and track improvements, and continue learning across preparation, detection, response, and recovery.

Record lessons but avoid changing procedures so that future responses remain consistent.

Focus improvement only on the final recovery stage.

True

False

Wait until an incident occurs to decide who can make response decisions.

Assign response roles, decision-making authority, escalation paths, and backup contacts in advance.

Let each responder choose their own communication channels during an incident.

Avoid documenting likely incident scenarios so responders can remain flexible.

Keep the server connected until the investigation is complete, regardless of the threat.

Disconnect the server immediately in every case, without considering service impact or evidence.

Weigh the risk of continued attacker activity against service impact, preserve evidence when possible, and act urgently when needed to limit serious harm.

Avoid recording containment changes so responders can adjust them quickly.

Delete the visible malicious file and immediately close the incident.

Investigate the entry point, attacker access, affected systems and accounts, and possible persistence mechanisms.

Restore only the visibly affected device without checking how the compromise occurred.

Preserve the compromised access mechanisms until all services are restored.