D340 Cyber Defense and Countermeasures - Set 4 - Part 2

Correct Answer: Coordinating the overall response and making decisions

The incident commander maintains overall situational awareness, coordinates activity, and makes decisions, rather than performing hands-on technical work.

Correct Answer: The attacker may be monitoring internal email and chat

If the attacker has access to internal communications, discussing response plans there reveals the strategy, so separate channels preserve operational security.

Correct Answer: Applicable law based on data types affected and jurisdiction

Breach notification obligations depend on jurisdiction, the categories of data involved, and assessed risk to individuals, with defined reporting deadlines.

Correct Answer: Notification obligations and privilege considerations arise immediately

Legal counsel advises on regulatory notification timelines, evidence handling, contractual duties, and preserving privilege over investigative communications.

Correct Answer: Timely, accurate, and clear information about impact and protective steps

Prompt, honest communication explaining what happened, what data was affected, and what individuals should do preserves trust and usually satisfies legal duties.

Correct Answer: Subsequent correction damages credibility and may create legal exposure

Downplaying impact that later proves greater destroys trust and can constitute misrepresentation, compounding reputational and legal consequences.

Correct Answer: Systems and data become unavailable, halting business operations

Ransomware attacks availability directly, encrypting systems so operations stop entirely, which creates intense pressure alongside the data confidentiality concerns.

Correct Answer: It funds criminal operations and encourages further attacks without guaranteeing recovery

Payment finances criminal enterprises and incentivizes more attacks, and decryption tools often work poorly or incompletely even when provided.

Correct Answer: Data is stolen before encryption and its release is threatened

Attackers exfiltrate data before encrypting, so even organizations that restore from backup face pressure to pay to prevent publication of stolen data.

Correct Answer: Backups restore availability but cannot undo data theft

Backups address the encryption but not the exfiltration, so preventing data theft requires detection and egress controls in addition to recovery capability.

Correct Answer: Which processes are critical and how quickly they must be restored

A BIA identifies critical business functions, their dependencies, and tolerable downtime, driving recovery priorities and objectives.

Correct Answer: The maximum acceptable duration to restore a service

RTO defines how quickly a service must be restored after disruption, driving the architecture and resources required for recovery.

Correct Answer: The maximum acceptable data loss measured in time

RPO defines how much data the organization can afford to lose, determining how frequently backups or replication must occur.

Correct Answer: The ability to continue operating and recover despite adverse events

Resilience accepts that disruptions will occur and focuses on maintaining essential functions and recovering quickly rather than assuming prevention will always succeed.

Correct Answer: Providing alternate infrastructure to restore operations after a major event

A recovery site provides alternate infrastructure, ranging from a cold site with space and power to a hot site running synchronized systems ready for failover.

Correct Answer: A hot site is fully equipped and ready for immediate failover

A hot site maintains running synchronized systems enabling rapid failover at high cost, while a cold site provides only facilities requiring lengthy setup.

Correct Answer: Untested plans routinely contain assumptions that fail in practice

Testing reveals missing dependencies, outdated contacts, insufficient capacity, and procedural gaps that documentation review cannot surface.

Correct Answer: Decision-making, roles, and communication under a simulated scenario

Tabletop exercises test human coordination, decision-making, and communication without the cost and disruption of technical failover testing.

Correct Answer: That systems can genuinely operate from the recovery environment

A full failover test actually shifts operations to the recovery environment, proving technical capability and revealing dependencies that documentation missed.

Correct Answer: Suppliers and service providers may be affected or required for recovery

Modern operations depend heavily on external providers, so response plans must address supplier incidents, contact paths, and contractual obligations.