Skip to content
Oluma Cyber Security Awareness
Join Us
Incident Response Fundamentals — Practice Exam | Oluma Digital
Cert Zone · Incident Response

Incident Response Fundamentals

IR-F

Oluma Digital Practice: Incident Response Fundamentals

This practice page helps learners review the incident response life cycle, detection, analysis, containment, eradication, recovery, communications, evidence handling, and lessons learned.

Managed by
Oluma Digital / Provider Neutral
Exam code
IR-F
Level
Fundamentals
Delivery
Provider dependent
Duration
Practice assessment
Passing score
Study score only
Audience
Security and privacy learners
Questions here
100 practice items
Format
Multiple choice
Reference / official page → IR-F

What this practice exam covers

Questions are grouped into study-friendly domains for certification and job-readiness review.

01

Preparation

Policies, playbooks, roles, tooling, communication plans, tabletop exercises, and readiness.

02

Detection and analysis

Alert validation, scoping, evidence collection, impact assessment, root cause, and prioritization.

03

Containment, eradication, and recovery

Short-term containment, long-term containment, eradication, restoration, monitoring, and validation.

04

Post-incident activities

Lessons learned, reporting, metrics, control improvements, and documentation.

These are unofficial practice questions. Always verify the current provider syllabus or official exam outline before testing.

Practice questions

Number of questions:

Pick a length, then choose an answer for instant feedback. Your score tracks below and counts only the questions you can see.

Preparation

Which option best describes Incident response policy?

✓ Access granted.  Incident response policy is the concept or activity most directly connected to this practice exam objective.
✗ Access denied.  Correct answer: Incident response policy. Incident response policy is the concept or activity most directly connected to this practice exam objective.
Detection and analysis

A practitioner is reviewing Incident response plan. What should it be associated with?

✓ Access granted.  The scenario points to Incident response plan, which is part of the related professional knowledge area.
✗ Access denied.  Correct answer: A security, privacy, operations, engineering, or architecture activity involving Incident response plan. The scenario points to Incident response plan, which is part of the related professional knowledge area.
Containment, eradication, and recovery

In an exam scenario, when is IR playbook the BEST answer?

✓ Access granted.  Choose IR playbook when the scenario asks for that control, process, design area, or management concept.
✗ Access denied.  Correct answer: When the requirement specifically asks about IR playbook. Choose IR playbook when the scenario asks for that control, process, design area, or management concept.
Post-incident activities

Which item is MOST relevant to RACI matrix?

✓ Access granted.  RACI matrix is the relevant term; the other choices are unrelated distractors.
✗ Access denied.  Correct answer: RACI matrix. RACI matrix is the relevant term; the other choices are unrelated distractors.
Preparation

Which option best describes Communication plan?

✓ Access granted.  Communication plan is the concept or activity most directly connected to this practice exam objective.
✗ Access denied.  Correct answer: Communication plan. Communication plan is the concept or activity most directly connected to this practice exam objective.
Detection and analysis

A practitioner is reviewing Tabletop exercise. What should it be associated with?

✓ Access granted.  The scenario points to Tabletop exercise, which is part of the related professional knowledge area.
✗ Access denied.  Correct answer: A security, privacy, operations, engineering, or architecture activity involving Tabletop exercise. The scenario points to Tabletop exercise, which is part of the related professional knowledge area.
Containment, eradication, and recovery

In an exam scenario, when is Incident commander the BEST answer?

✓ Access granted.  Choose Incident commander when the scenario asks for that control, process, design area, or management concept.
✗ Access denied.  Correct answer: When the requirement specifically asks about Incident commander. Choose Incident commander when the scenario asks for that control, process, design area, or management concept.
Post-incident activities

Which item is MOST relevant to Incident handler?

✓ Access granted.  Incident handler is the relevant term; the other choices are unrelated distractors.
✗ Access denied.  Correct answer: Incident handler. Incident handler is the relevant term; the other choices are unrelated distractors.
Preparation

Which option best describes Evidence preservation?

✓ Access granted.  Evidence preservation is the concept or activity most directly connected to this practice exam objective.
✗ Access denied.  Correct answer: Evidence preservation. Evidence preservation is the concept or activity most directly connected to this practice exam objective.
Detection and analysis

A practitioner is reviewing Chain of custody. What should it be associated with?

✓ Access granted.  The scenario points to Chain of custody, which is part of the related professional knowledge area.
✗ Access denied.  Correct answer: A security, privacy, operations, engineering, or architecture activity involving Chain of custody. The scenario points to Chain of custody, which is part of the related professional knowledge area.
Containment, eradication, and recovery

In an exam scenario, when is Initial detection the BEST answer?

✓ Access granted.  Choose Initial detection when the scenario asks for that control, process, design area, or management concept.
✗ Access denied.  Correct answer: When the requirement specifically asks about Initial detection. Choose Initial detection when the scenario asks for that control, process, design area, or management concept.
Post-incident activities

Which item is MOST relevant to Alert validation?

✓ Access granted.  Alert validation is the relevant term; the other choices are unrelated distractors.
✗ Access denied.  Correct answer: Alert validation. Alert validation is the relevant term; the other choices are unrelated distractors.
Preparation

Which option best describes Event correlation?

✓ Access granted.  Event correlation is the concept or activity most directly connected to this practice exam objective.
✗ Access denied.  Correct answer: Event correlation. Event correlation is the concept or activity most directly connected to this practice exam objective.
Detection and analysis

A practitioner is reviewing Incident classification. What should it be associated with?

✓ Access granted.  The scenario points to Incident classification, which is part of the related professional knowledge area.
✗ Access denied.  Correct answer: A security, privacy, operations, engineering, or architecture activity involving Incident classification. The scenario points to Incident classification, which is part of the related professional knowledge area.
Containment, eradication, and recovery

In an exam scenario, when is Impact assessment the BEST answer?

✓ Access granted.  Choose Impact assessment when the scenario asks for that control, process, design area, or management concept.
✗ Access denied.  Correct answer: When the requirement specifically asks about Impact assessment. Choose Impact assessment when the scenario asks for that control, process, design area, or management concept.
Post-incident activities

Which item is MOST relevant to Scope determination?

✓ Access granted.  Scope determination is the relevant term; the other choices are unrelated distractors.
✗ Access denied.  Correct answer: Scope determination. Scope determination is the relevant term; the other choices are unrelated distractors.
Preparation

Which option best describes Root cause analysis?

✓ Access granted.  Root cause analysis is the concept or activity most directly connected to this practice exam objective.
✗ Access denied.  Correct answer: Root cause analysis. Root cause analysis is the concept or activity most directly connected to this practice exam objective.
Detection and analysis

A practitioner is reviewing Forensic image. What should it be associated with?

✓ Access granted.  The scenario points to Forensic image, which is part of the related professional knowledge area.
✗ Access denied.  Correct answer: A security, privacy, operations, engineering, or architecture activity involving Forensic image. The scenario points to Forensic image, which is part of the related professional knowledge area.
Containment, eradication, and recovery

In an exam scenario, when is Memory capture the BEST answer?

✓ Access granted.  Choose Memory capture when the scenario asks for that control, process, design area, or management concept.
✗ Access denied.  Correct answer: When the requirement specifically asks about Memory capture. Choose Memory capture when the scenario asks for that control, process, design area, or management concept.
Post-incident activities

Which item is MOST relevant to Log collection?

✓ Access granted.  Log collection is the relevant term; the other choices are unrelated distractors.
✗ Access denied.  Correct answer: Log collection. Log collection is the relevant term; the other choices are unrelated distractors.
Preparation

Which option best describes Malware analysis?

✓ Access granted.  Malware analysis is the concept or activity most directly connected to this practice exam objective.
✗ Access denied.  Correct answer: Malware analysis. Malware analysis is the concept or activity most directly connected to this practice exam objective.
Detection and analysis

A practitioner is reviewing Phishing investigation. What should it be associated with?

✓ Access granted.  The scenario points to Phishing investigation, which is part of the related professional knowledge area.
✗ Access denied.  Correct answer: A security, privacy, operations, engineering, or architecture activity involving Phishing investigation. The scenario points to Phishing investigation, which is part of the related professional knowledge area.
Containment, eradication, and recovery

In an exam scenario, when is Credential compromise the BEST answer?

✓ Access granted.  Choose Credential compromise when the scenario asks for that control, process, design area, or management concept.
✗ Access denied.  Correct answer: When the requirement specifically asks about Credential compromise. Choose Credential compromise when the scenario asks for that control, process, design area, or management concept.
Post-incident activities

Which item is MOST relevant to Ransomware response?

✓ Access granted.  Ransomware response is the relevant term; the other choices are unrelated distractors.
✗ Access denied.  Correct answer: Ransomware response. Ransomware response is the relevant term; the other choices are unrelated distractors.
Preparation

Which option best describes Containment strategy?

✓ Access granted.  Containment strategy is the concept or activity most directly connected to this practice exam objective.
✗ Access denied.  Correct answer: Containment strategy. Containment strategy is the concept or activity most directly connected to this practice exam objective.
Detection and analysis

A practitioner is reviewing Network isolation. What should it be associated with?

✓ Access granted.  The scenario points to Network isolation, which is part of the related professional knowledge area.
✗ Access denied.  Correct answer: A security, privacy, operations, engineering, or architecture activity involving Network isolation. The scenario points to Network isolation, which is part of the related professional knowledge area.
Containment, eradication, and recovery

In an exam scenario, when is Account disablement the BEST answer?

✓ Access granted.  Choose Account disablement when the scenario asks for that control, process, design area, or management concept.
✗ Access denied.  Correct answer: When the requirement specifically asks about Account disablement. Choose Account disablement when the scenario asks for that control, process, design area, or management concept.
Post-incident activities

Which item is MOST relevant to Host quarantine?

✓ Access granted.  Host quarantine is the relevant term; the other choices are unrelated distractors.
✗ Access denied.  Correct answer: Host quarantine. Host quarantine is the relevant term; the other choices are unrelated distractors.
Preparation

Which option best describes Firewall block?

✓ Access granted.  Firewall block is the concept or activity most directly connected to this practice exam objective.
✗ Access denied.  Correct answer: Firewall block. Firewall block is the concept or activity most directly connected to this practice exam objective.
Detection and analysis

A practitioner is reviewing Eradication. What should it be associated with?

✓ Access granted.  The scenario points to Eradication, which is part of the related professional knowledge area.
✗ Access denied.  Correct answer: A security, privacy, operations, engineering, or architecture activity involving Eradication. The scenario points to Eradication, which is part of the related professional knowledge area.
Containment, eradication, and recovery

In an exam scenario, when is Persistence removal the BEST answer?

✓ Access granted.  Choose Persistence removal when the scenario asks for that control, process, design area, or management concept.
✗ Access denied.  Correct answer: When the requirement specifically asks about Persistence removal. Choose Persistence removal when the scenario asks for that control, process, design area, or management concept.
Post-incident activities

Which item is MOST relevant to Patch remediation?

✓ Access granted.  Patch remediation is the relevant term; the other choices are unrelated distractors.
✗ Access denied.  Correct answer: Patch remediation. Patch remediation is the relevant term; the other choices are unrelated distractors.
Preparation

Which option best describes Credential rotation?

✓ Access granted.  Credential rotation is the concept or activity most directly connected to this practice exam objective.
✗ Access denied.  Correct answer: Credential rotation. Credential rotation is the concept or activity most directly connected to this practice exam objective.
Detection and analysis

A practitioner is reviewing Recovery plan. What should it be associated with?

✓ Access granted.  The scenario points to Recovery plan, which is part of the related professional knowledge area.
✗ Access denied.  Correct answer: A security, privacy, operations, engineering, or architecture activity involving Recovery plan. The scenario points to Recovery plan, which is part of the related professional knowledge area.
Containment, eradication, and recovery

In an exam scenario, when is System restoration the BEST answer?

✓ Access granted.  Choose System restoration when the scenario asks for that control, process, design area, or management concept.
✗ Access denied.  Correct answer: When the requirement specifically asks about System restoration. Choose System restoration when the scenario asks for that control, process, design area, or management concept.
Post-incident activities

Which item is MOST relevant to Backup validation?

✓ Access granted.  Backup validation is the relevant term; the other choices are unrelated distractors.
✗ Access denied.  Correct answer: Backup validation. Backup validation is the relevant term; the other choices are unrelated distractors.
Preparation

Which option best describes Monitoring after recovery?

✓ Access granted.  Monitoring after recovery is the concept or activity most directly connected to this practice exam objective.
✗ Access denied.  Correct answer: Monitoring after recovery. Monitoring after recovery is the concept or activity most directly connected to this practice exam objective.
Detection and analysis

A practitioner is reviewing Business communication. What should it be associated with?

✓ Access granted.  The scenario points to Business communication, which is part of the related professional knowledge area.
✗ Access denied.  Correct answer: A security, privacy, operations, engineering, or architecture activity involving Business communication. The scenario points to Business communication, which is part of the related professional knowledge area.
Containment, eradication, and recovery

In an exam scenario, when is Legal notification the BEST answer?

✓ Access granted.  Choose Legal notification when the scenario asks for that control, process, design area, or management concept.
✗ Access denied.  Correct answer: When the requirement specifically asks about Legal notification. Choose Legal notification when the scenario asks for that control, process, design area, or management concept.
Post-incident activities

Which item is MOST relevant to Regulator notification?

✓ Access granted.  Regulator notification is the relevant term; the other choices are unrelated distractors.
✗ Access denied.  Correct answer: Regulator notification. Regulator notification is the relevant term; the other choices are unrelated distractors.
Preparation

Which option best describes Customer notification?

✓ Access granted.  Customer notification is the concept or activity most directly connected to this practice exam objective.
✗ Access denied.  Correct answer: Customer notification. Customer notification is the concept or activity most directly connected to this practice exam objective.
Detection and analysis

A practitioner is reviewing Executive briefing. What should it be associated with?

✓ Access granted.  The scenario points to Executive briefing, which is part of the related professional knowledge area.
✗ Access denied.  Correct answer: A security, privacy, operations, engineering, or architecture activity involving Executive briefing. The scenario points to Executive briefing, which is part of the related professional knowledge area.
Containment, eradication, and recovery

In an exam scenario, when is Situation report the BEST answer?

✓ Access granted.  Choose Situation report when the scenario asks for that control, process, design area, or management concept.
✗ Access denied.  Correct answer: When the requirement specifically asks about Situation report. Choose Situation report when the scenario asks for that control, process, design area, or management concept.
Post-incident activities

Which item is MOST relevant to Incident timeline?

✓ Access granted.  Incident timeline is the relevant term; the other choices are unrelated distractors.
✗ Access denied.  Correct answer: Incident timeline. Incident timeline is the relevant term; the other choices are unrelated distractors.
Preparation

Which option best describes Lessons learned?

✓ Access granted.  Lessons learned is the concept or activity most directly connected to this practice exam objective.
✗ Access denied.  Correct answer: Lessons learned. Lessons learned is the concept or activity most directly connected to this practice exam objective.
Detection and analysis

A practitioner is reviewing After-action report. What should it be associated with?

✓ Access granted.  The scenario points to After-action report, which is part of the related professional knowledge area.
✗ Access denied.  Correct answer: A security, privacy, operations, engineering, or architecture activity involving After-action report. The scenario points to After-action report, which is part of the related professional knowledge area.
Containment, eradication, and recovery

In an exam scenario, when is Corrective action the BEST answer?

✓ Access granted.  Choose Corrective action when the scenario asks for that control, process, design area, or management concept.
✗ Access denied.  Correct answer: When the requirement specifically asks about Corrective action. Choose Corrective action when the scenario asks for that control, process, design area, or management concept.
Post-incident activities

Which item is MOST relevant to Control improvement?

✓ Access granted.  Control improvement is the relevant term; the other choices are unrelated distractors.
✗ Access denied.  Correct answer: Control improvement. Control improvement is the relevant term; the other choices are unrelated distractors.
Preparation

Which option best describes MTTD?

✓ Access granted.  MTTD is the concept or activity most directly connected to this practice exam objective.
✗ Access denied.  Correct answer: MTTD. MTTD is the concept or activity most directly connected to this practice exam objective.
Detection and analysis

A practitioner is reviewing MTTR. What should it be associated with?

✓ Access granted.  The scenario points to MTTR, which is part of the related professional knowledge area.
✗ Access denied.  Correct answer: A security, privacy, operations, engineering, or architecture activity involving MTTR. The scenario points to MTTR, which is part of the related professional knowledge area.
Containment, eradication, and recovery

In an exam scenario, when is Incident response policy the BEST answer?

✓ Access granted.  Choose Incident response policy when the scenario asks for that control, process, design area, or management concept.
✗ Access denied.  Correct answer: When the requirement specifically asks about Incident response policy. Choose Incident response policy when the scenario asks for that control, process, design area, or management concept.
Post-incident activities

Which item is MOST relevant to Incident response plan?

✓ Access granted.  Incident response plan is the relevant term; the other choices are unrelated distractors.
✗ Access denied.  Correct answer: Incident response plan. Incident response plan is the relevant term; the other choices are unrelated distractors.
Preparation

Which option best describes IR playbook?

✓ Access granted.  IR playbook is the concept or activity most directly connected to this practice exam objective.
✗ Access denied.  Correct answer: IR playbook. IR playbook is the concept or activity most directly connected to this practice exam objective.
Detection and analysis

A practitioner is reviewing RACI matrix. What should it be associated with?

✓ Access granted.  The scenario points to RACI matrix, which is part of the related professional knowledge area.
✗ Access denied.  Correct answer: A security, privacy, operations, engineering, or architecture activity involving RACI matrix. The scenario points to RACI matrix, which is part of the related professional knowledge area.
Containment, eradication, and recovery

In an exam scenario, when is Communication plan the BEST answer?

✓ Access granted.  Choose Communication plan when the scenario asks for that control, process, design area, or management concept.
✗ Access denied.  Correct answer: When the requirement specifically asks about Communication plan. Choose Communication plan when the scenario asks for that control, process, design area, or management concept.
Post-incident activities

Which item is MOST relevant to Tabletop exercise?

✓ Access granted.  Tabletop exercise is the relevant term; the other choices are unrelated distractors.
✗ Access denied.  Correct answer: Tabletop exercise. Tabletop exercise is the relevant term; the other choices are unrelated distractors.
Preparation

Which option best describes Incident commander?

✓ Access granted.  Incident commander is the concept or activity most directly connected to this practice exam objective.
✗ Access denied.  Correct answer: Incident commander. Incident commander is the concept or activity most directly connected to this practice exam objective.
Detection and analysis

A practitioner is reviewing Incident handler. What should it be associated with?

✓ Access granted.  The scenario points to Incident handler, which is part of the related professional knowledge area.
✗ Access denied.  Correct answer: A security, privacy, operations, engineering, or architecture activity involving Incident handler. The scenario points to Incident handler, which is part of the related professional knowledge area.
Containment, eradication, and recovery

In an exam scenario, when is Evidence preservation the BEST answer?

✓ Access granted.  Choose Evidence preservation when the scenario asks for that control, process, design area, or management concept.
✗ Access denied.  Correct answer: When the requirement specifically asks about Evidence preservation. Choose Evidence preservation when the scenario asks for that control, process, design area, or management concept.
Post-incident activities

Which item is MOST relevant to Chain of custody?

✓ Access granted.  Chain of custody is the relevant term; the other choices are unrelated distractors.
✗ Access denied.  Correct answer: Chain of custody. Chain of custody is the relevant term; the other choices are unrelated distractors.
Preparation

Which option best describes Initial detection?

✓ Access granted.  Initial detection is the concept or activity most directly connected to this practice exam objective.
✗ Access denied.  Correct answer: Initial detection. Initial detection is the concept or activity most directly connected to this practice exam objective.
Detection and analysis

A practitioner is reviewing Alert validation. What should it be associated with?

✓ Access granted.  The scenario points to Alert validation, which is part of the related professional knowledge area.
✗ Access denied.  Correct answer: A security, privacy, operations, engineering, or architecture activity involving Alert validation. The scenario points to Alert validation, which is part of the related professional knowledge area.
Containment, eradication, and recovery

In an exam scenario, when is Event correlation the BEST answer?

✓ Access granted.  Choose Event correlation when the scenario asks for that control, process, design area, or management concept.
✗ Access denied.  Correct answer: When the requirement specifically asks about Event correlation. Choose Event correlation when the scenario asks for that control, process, design area, or management concept.
Post-incident activities

Which item is MOST relevant to Incident classification?

✓ Access granted.  Incident classification is the relevant term; the other choices are unrelated distractors.
✗ Access denied.  Correct answer: Incident classification. Incident classification is the relevant term; the other choices are unrelated distractors.
Preparation

Which option best describes Impact assessment?

✓ Access granted.  Impact assessment is the concept or activity most directly connected to this practice exam objective.
✗ Access denied.  Correct answer: Impact assessment. Impact assessment is the concept or activity most directly connected to this practice exam objective.
Detection and analysis

A practitioner is reviewing Scope determination. What should it be associated with?

✓ Access granted.  The scenario points to Scope determination, which is part of the related professional knowledge area.
✗ Access denied.  Correct answer: A security, privacy, operations, engineering, or architecture activity involving Scope determination. The scenario points to Scope determination, which is part of the related professional knowledge area.
Containment, eradication, and recovery

In an exam scenario, when is Root cause analysis the BEST answer?

✓ Access granted.  Choose Root cause analysis when the scenario asks for that control, process, design area, or management concept.
✗ Access denied.  Correct answer: When the requirement specifically asks about Root cause analysis. Choose Root cause analysis when the scenario asks for that control, process, design area, or management concept.
Post-incident activities

Which item is MOST relevant to Forensic image?

✓ Access granted.  Forensic image is the relevant term; the other choices are unrelated distractors.
✗ Access denied.  Correct answer: Forensic image. Forensic image is the relevant term; the other choices are unrelated distractors.
Preparation

Which option best describes Memory capture?

✓ Access granted.  Memory capture is the concept or activity most directly connected to this practice exam objective.
✗ Access denied.  Correct answer: Memory capture. Memory capture is the concept or activity most directly connected to this practice exam objective.
Detection and analysis

A practitioner is reviewing Log collection. What should it be associated with?

✓ Access granted.  The scenario points to Log collection, which is part of the related professional knowledge area.
✗ Access denied.  Correct answer: A security, privacy, operations, engineering, or architecture activity involving Log collection. The scenario points to Log collection, which is part of the related professional knowledge area.
Containment, eradication, and recovery

In an exam scenario, when is Malware analysis the BEST answer?

✓ Access granted.  Choose Malware analysis when the scenario asks for that control, process, design area, or management concept.
✗ Access denied.  Correct answer: When the requirement specifically asks about Malware analysis. Choose Malware analysis when the scenario asks for that control, process, design area, or management concept.
Post-incident activities

Which item is MOST relevant to Phishing investigation?

✓ Access granted.  Phishing investigation is the relevant term; the other choices are unrelated distractors.
✗ Access denied.  Correct answer: Phishing investigation. Phishing investigation is the relevant term; the other choices are unrelated distractors.
Preparation

Which option best describes Credential compromise?

✓ Access granted.  Credential compromise is the concept or activity most directly connected to this practice exam objective.
✗ Access denied.  Correct answer: Credential compromise. Credential compromise is the concept or activity most directly connected to this practice exam objective.
Detection and analysis

A practitioner is reviewing Ransomware response. What should it be associated with?

✓ Access granted.  The scenario points to Ransomware response, which is part of the related professional knowledge area.
✗ Access denied.  Correct answer: A security, privacy, operations, engineering, or architecture activity involving Ransomware response. The scenario points to Ransomware response, which is part of the related professional knowledge area.
Containment, eradication, and recovery

In an exam scenario, when is Containment strategy the BEST answer?

✓ Access granted.  Choose Containment strategy when the scenario asks for that control, process, design area, or management concept.
✗ Access denied.  Correct answer: When the requirement specifically asks about Containment strategy. Choose Containment strategy when the scenario asks for that control, process, design area, or management concept.
Post-incident activities

Which item is MOST relevant to Network isolation?

✓ Access granted.  Network isolation is the relevant term; the other choices are unrelated distractors.
✗ Access denied.  Correct answer: Network isolation. Network isolation is the relevant term; the other choices are unrelated distractors.
Preparation

Which option best describes Account disablement?

✓ Access granted.  Account disablement is the concept or activity most directly connected to this practice exam objective.
✗ Access denied.  Correct answer: Account disablement. Account disablement is the concept or activity most directly connected to this practice exam objective.
Detection and analysis

A practitioner is reviewing Host quarantine. What should it be associated with?

✓ Access granted.  The scenario points to Host quarantine, which is part of the related professional knowledge area.
✗ Access denied.  Correct answer: A security, privacy, operations, engineering, or architecture activity involving Host quarantine. The scenario points to Host quarantine, which is part of the related professional knowledge area.
Containment, eradication, and recovery

In an exam scenario, when is Firewall block the BEST answer?

✓ Access granted.  Choose Firewall block when the scenario asks for that control, process, design area, or management concept.
✗ Access denied.  Correct answer: When the requirement specifically asks about Firewall block. Choose Firewall block when the scenario asks for that control, process, design area, or management concept.
Post-incident activities

Which item is MOST relevant to Eradication?

✓ Access granted.  Eradication is the relevant term; the other choices are unrelated distractors.
✗ Access denied.  Correct answer: Eradication. Eradication is the relevant term; the other choices are unrelated distractors.
Preparation

Which option best describes Persistence removal?

✓ Access granted.  Persistence removal is the concept or activity most directly connected to this practice exam objective.
✗ Access denied.  Correct answer: Persistence removal. Persistence removal is the concept or activity most directly connected to this practice exam objective.
Detection and analysis

A practitioner is reviewing Patch remediation. What should it be associated with?

✓ Access granted.  The scenario points to Patch remediation, which is part of the related professional knowledge area.
✗ Access denied.  Correct answer: A security, privacy, operations, engineering, or architecture activity involving Patch remediation. The scenario points to Patch remediation, which is part of the related professional knowledge area.
Containment, eradication, and recovery

In an exam scenario, when is Credential rotation the BEST answer?

✓ Access granted.  Choose Credential rotation when the scenario asks for that control, process, design area, or management concept.
✗ Access denied.  Correct answer: When the requirement specifically asks about Credential rotation. Choose Credential rotation when the scenario asks for that control, process, design area, or management concept.
Post-incident activities

Which item is MOST relevant to Recovery plan?

✓ Access granted.  Recovery plan is the relevant term; the other choices are unrelated distractors.
✗ Access denied.  Correct answer: Recovery plan. Recovery plan is the relevant term; the other choices are unrelated distractors.
Preparation

Which option best describes System restoration?

✓ Access granted.  System restoration is the concept or activity most directly connected to this practice exam objective.
✗ Access denied.  Correct answer: System restoration. System restoration is the concept or activity most directly connected to this practice exam objective.
Detection and analysis

A practitioner is reviewing Backup validation. What should it be associated with?

✓ Access granted.  The scenario points to Backup validation, which is part of the related professional knowledge area.
✗ Access denied.  Correct answer: A security, privacy, operations, engineering, or architecture activity involving Backup validation. The scenario points to Backup validation, which is part of the related professional knowledge area.
Containment, eradication, and recovery

In an exam scenario, when is Monitoring after recovery the BEST answer?

✓ Access granted.  Choose Monitoring after recovery when the scenario asks for that control, process, design area, or management concept.
✗ Access denied.  Correct answer: When the requirement specifically asks about Monitoring after recovery. Choose Monitoring after recovery when the scenario asks for that control, process, design area, or management concept.
Post-incident activities

Which item is MOST relevant to Business communication?

✓ Access granted.  Business communication is the relevant term; the other choices are unrelated distractors.
✗ Access denied.  Correct answer: Business communication. Business communication is the relevant term; the other choices are unrelated distractors.
Preparation

Which option best describes Legal notification?

✓ Access granted.  Legal notification is the concept or activity most directly connected to this practice exam objective.
✗ Access denied.  Correct answer: Legal notification. Legal notification is the concept or activity most directly connected to this practice exam objective.
Detection and analysis

A practitioner is reviewing Regulator notification. What should it be associated with?

✓ Access granted.  The scenario points to Regulator notification, which is part of the related professional knowledge area.
✗ Access denied.  Correct answer: A security, privacy, operations, engineering, or architecture activity involving Regulator notification. The scenario points to Regulator notification, which is part of the related professional knowledge area.
Containment, eradication, and recovery

In an exam scenario, when is Customer notification the BEST answer?

✓ Access granted.  Choose Customer notification when the scenario asks for that control, process, design area, or management concept.
✗ Access denied.  Correct answer: When the requirement specifically asks about Customer notification. Choose Customer notification when the scenario asks for that control, process, design area, or management concept.
Post-incident activities

Which item is MOST relevant to Executive briefing?

✓ Access granted.  Executive briefing is the relevant term; the other choices are unrelated distractors.
✗ Access denied.  Correct answer: Executive briefing. Executive briefing is the relevant term; the other choices are unrelated distractors.
Preparation

Which option best describes Situation report?

✓ Access granted.  Situation report is the concept or activity most directly connected to this practice exam objective.
✗ Access denied.  Correct answer: Situation report. Situation report is the concept or activity most directly connected to this practice exam objective.
Detection and analysis

A practitioner is reviewing Incident timeline. What should it be associated with?

✓ Access granted.  The scenario points to Incident timeline, which is part of the related professional knowledge area.
✗ Access denied.  Correct answer: A security, privacy, operations, engineering, or architecture activity involving Incident timeline. The scenario points to Incident timeline, which is part of the related professional knowledge area.
Containment, eradication, and recovery

In an exam scenario, when is Lessons learned the BEST answer?

✓ Access granted.  Choose Lessons learned when the scenario asks for that control, process, design area, or management concept.
✗ Access denied.  Correct answer: When the requirement specifically asks about Lessons learned. Choose Lessons learned when the scenario asks for that control, process, design area, or management concept.
Post-incident activities

Which item is MOST relevant to After-action report?

✓ Access granted.  After-action report is the relevant term; the other choices are unrelated distractors.
✗ Access denied.  Correct answer: After-action report. After-action report is the relevant term; the other choices are unrelated distractors.
Preparation

Which option best describes Corrective action?

✓ Access granted.  Corrective action is the concept or activity most directly connected to this practice exam objective.
✗ Access denied.  Correct answer: Corrective action. Corrective action is the concept or activity most directly connected to this practice exam objective.
Detection and analysis

A practitioner is reviewing Control improvement. What should it be associated with?

✓ Access granted.  The scenario points to Control improvement, which is part of the related professional knowledge area.
✗ Access denied.  Correct answer: A security, privacy, operations, engineering, or architecture activity involving Control improvement. The scenario points to Control improvement, which is part of the related professional knowledge area.
Containment, eradication, and recovery

In an exam scenario, when is MTTD the BEST answer?

✓ Access granted.  Choose MTTD when the scenario asks for that control, process, design area, or management concept.
✗ Access denied.  Correct answer: When the requirement specifically asks about MTTD. Choose MTTD when the scenario asks for that control, process, design area, or management concept.
Post-incident activities

Which item is MOST relevant to MTTR?

✓ Access granted.  MTTR is the relevant term; the other choices are unrelated distractors.
✗ Access denied.  Correct answer: MTTR. MTTR is the relevant term; the other choices are unrelated distractors.

Ready to keep building your skills?

Use this practice page to review terminology, processes, and exam-style decision points before moving into official or provider-specific study materials.

Reference pageBack to Cert Zone

Unofficial practice questions created by Oluma Digital for study purposes. Not affiliated with or endorsed by IAPP, ISC2, OffSec, Cisco, Coursera, or any certification body. Always verify current objectives with the official provider.

0Correct0Answered25Visible