ISO 27000 Foundation Certification Information Security Incident Management 3

Question 1

What is the purpose of an incident communication plan in information security?

Accepted Answer

To define how, when, and to whom information about incidents is communicated

Answer

To market the organization's security capabilities to potential clients

Answer

To document all technical vulnerabilities discovered during an incident

Answer

To replace the need for a dedicated incident response team

Question 2

What does 'dwell time' refer to in the context of information security incidents?

Accepted Answer

The period an attacker remains undetected within a compromised system

Answer

The time taken to fully restore systems and services after an incident is resolved

Answer

The time elapsed between incident detection and successful containment

Answer

The duration required to write and submit a formal incident report

Question 3

Which concept best describes 'lessons learned' in incident management?

Accepted Answer

A structured post-incident review to identify improvements in prevention and response

Answer

Formal training provided to new security team members following a major incident

Answer

Legal proceedings and liability determination following a significant data breach

Answer

Applying software patches and updates after a vulnerability has been exploited

Question 4

According to ISO 27000, what is a 'threat' in information security?

Accepted Answer

A potential cause of an unwanted incident that may result in harm to assets

Answer

A weakness in an organization's security controls or procedures

Answer

A confirmed and active attack currently targeting information assets

Answer

An unauthorized user who has already accessed a protected system

Question 5

What is the key difference between reactive and proactive incident management approaches?

Accepted Answer

Proactive management involves threat hunting before incidents occur; reactive management responds after detection

Answer

Reactive management prevents incidents; proactive management responds after detection

Answer

There is no significant outcome difference between reactive and proactive management

Answer

Proactive incident management is only cost-effective for large enterprise organizations

Question 6

What role does forensic analysis play in information security incident management?

Accepted Answer

It collects and analyzes digital evidence to understand how an incident occurred

Answer

It prevents incidents from recurring by automatically updating security controls

Answer

It fully automates the incident detection and response process

Answer

It solely assesses the financial and reputational impact of a security breach

Question 7

What is the relationship between information security incident management and business continuity planning?

Accepted Answer

Major security incidents may trigger business continuity plans, making them complementary

Answer

They are completely separate disciplines with no overlap or interaction

Answer

Business continuity planning fully replaces incident management for critical business systems

Answer

Incident management applies only to IT systems and not to broader business processes