Q1easy
What is the primary goal of the Recovery phase in incident management?
Back to Cyber Security
8 Questions TotalUnder 10 MCQs (Noindex)
Incident Response & Management MCQs
Topic-wise practice questions for Cyber Security. Test your knowledge, check solutions on demand, and pace your preparation.
Zero-leak answer engine • Rate-limited explanations
Practice in Timed ModeQ2medium
A security analyst detects that a server is currently communicating with a known malicious Command and Control (C&C) IP address. The analyst immediately disconnects the server from the network. Which phase of the PICERL framework is this?
Q3medium
Why is Communication Management considered a critical part of the Incident Response process?
Q4easy
What is the difference between Short-term Containment and Long- term Containment?
Q5medium
An IR team is deciding between "Live Imaging" of a server versus "Pulling the Plug." Which approach is preferred during Containment to ensure the best chance of successful analysis later?
Q6medium
During which phase of the Incident Response process is the "Root Cause Analysis" performed to ensure the vulnerability is fully patched before the system goes back online?
Q7easy
In the context of the Identification phase, what is an Indicator of Compromise (IoC)?
Q8medium
A CSIRT team is reviewing the following "Post-Mortem" log entry. Which phase of the IR lifecycle does this activity represent?