CC practice examsIn development

1. During the eradication phase of incident response, the team should:

1. Immediately restore from backups
2. Return to normal operations
3. Remove the root cause of the incident, such as malware, compromised accounts, and attacker tools, from all affected systems — correct
4. Notify all customers about the breach

Why: Eradication involves completely removing the root cause of the incident from all affected systems. This includes removing malware, closing exploited vulnerabilities, disabling compromised accounts, and eliminating attacker tools and backdoors. Incomplete eradication may allow the attacker to return.

2. A company's disaster recovery plan specifies a cold site as the recovery location. After a fire destroys their primary data center, they discover that setting up the cold site will take 2 weeks, but their RTO is 48 hours. What critical planning failure occurred?

1. The disaster recovery plan was not properly approved by senior management leadership
2. The cold site was located too far from the primary data center for efficient recovery
3. The company failed to account for the time needed to procure replacement equipment
4. The company should have chosen a hot site or warm site that meets the 48-hour RTO — correct

Why: The critical failure was selecting a recovery site type (cold site) that cannot meet the defined RTO. Cold sites provide only basic infrastructure and typically take weeks to become operational. A hot or warm site would have been necessary to meet a 48-hour RTO.