Incident Planning

1. A security manager schedules a meeting where the incident response team discusses a ransomware scenario step by step, making decisions verbally without accessing any systems. What type of exercise is this, and what is its primary limitation?

A. Simulation — it requires a test environment that the team does not have B. Tabletop exercise — because no systems are used, technical gaps such as missing credentials and unfamiliar tools are not revealed C. Red team exercise — the attacker perspective is represented by the facilitator D. Lessons-learned review — it identifies what went wrong after a real incident

2. During a phishing simulation, 35% of employees clicked the simulated link AND the phishing message bypassed the organization's email filtering entirely. What two failures does this result reveal?

A. Firewall misconfiguration and missing antivirus signatures B. Insufficient user security awareness training AND ineffective email filtering controls — both failed independently C. Inadequate network segmentation and poor endpoint hardening D. Weak password policy and missing MFA enrollment

3. An investigation concludes "the cause of the breach was a misconfigured firewall." A more thorough analyst asks why the firewall was misconfigured, discovering it was not reviewed because the change management process was bypassed due to time pressure. What root cause analysis failure does stopping at the first answer represent?

A. Tunnel vision — the analyst fixated on a proximate cause rather than continuing to ask why until the actual root cause was identified B. Alert fatigue — too many findings caused the analyst to stop investigating prematurely C. Single point of failure — the firewall had no redundant control in place D. Technical debt — the old change management system could not properly document firewall rules

4. A threat hunter hypothesizes that a nation-state actor is using PowerShell running from unusual parent processes to move laterally. The hunter searches EDR telemetry and SIEM data for this pattern and finds no evidence. What value does this hunt produce even without finding a compromise?

A. No value — a hunt that finds nothing demonstrates the technology is working but produces no actionable output B. The hunt confirms the hypothesized technique has not been used in the examined data, the methodology can be converted into an automated detection rule, and it improves understanding of normal environment behavior C. It generates a false positive alert that should be added to the exclusion list D. It confirms that EDR telemetry is complete and no gaps exist in log collection

5. A post-incident review identifies three contributing factors to a successful attack: an unpatched vulnerability, a user who clicked a phishing link, and a SIEM alert that was acknowledged but not investigated. The team patches the vulnerability and calls the review complete. What root cause analysis principle did the team violate?

A. The team should have blamed the user who clicked the link instead of focusing on technical issues B. The team addressed only one of multiple root causes; the unaddressed causes (user susceptibility and alert handling failure) remain active and can enable a future incident through a different path C. The team should have waited 30 days before completing the review to allow all evidence to be collected D. The team violated NIST SP 800-61 by not involving legal counsel in the review

6. Which statement correctly describes the relationship between threat intelligence and threat hunting?

A. Threat hunting replaces threat intelligence; once an organization begins hunting, threat feeds are no longer needed B. Threat intelligence is reactive (detects known bad indicators) while threat hunting is proactive (searches for unknown threats); both are necessary and complement each other C. Threat intelligence is proactive and threat hunting is reactive; intelligence identifies threats before they occur D. Threat hunting is a subset of penetration testing that focuses on network-layer attacks

Matching: Incident Planning Concepts

Match each concept (1–4) to its correct description (A–D).

1Tabletop exercise

2Phishing simulation

3Root cause analysis

4Threat hunting

AA proactive security discipline where analysts search for evidence of compromise or malicious activity that has not yet triggered any alert, using SIEM, EDR, and behavioral analytics

BA structured scenario discussion where IR team members make decisions verbally without executing actions on live systems; low cost and suitable for management participation

CA simulation that sends realistic lure messages to real users to measure click rates, credential submission, reporting behavior, and email filter effectiveness simultaneously

DA structured process for identifying the underlying causes of an incident by repeatedly asking why, avoiding blame, and producing fact-based recommendations that prevent recurrence

Incident Planning — Quiz