Back to Incident Response and Forensics

Incident Recovery

5 minutes 5 Questions

Incident Recovery is the process of restoring an organization's systems, data, and operations following a security incident. It involves a set of activities, such as cleaning infected systems, patching vulnerabilities, and restoring data from backups. The goal of incident recovery is to minimize di…

Test mode:
Start practice test
CompTIA Security+ - Incident Recovery Example Questions

Test your knowledge of Incident Recovery

Question 1

A security breach resulted in an organization losing sensitive customer data. What step should be taken during the recovery phase?

Correct Answer: Notify affected customers and offer identity theft protection services

Notifying affected customers and offering identity theft protection services is an important step, as it helps restore trust and limit the potential harm caused by the data breach. It also aligns with most data breach notification laws.

Question 2

A company has experienced a cyber attack, and the IT department has contained it. What should be the primary focus during the recovery phase?

Correct Answer: Restore system functionality and recover lost data

During the recovery phase of incident response, the main focus should be restoring system functionality and recovering lost data. Other actions may follow, but the primary goal is to get the organization's systems and network back to a functional state.

Question 3

A security professional has identified a server that has been compromised. They cannot confirm the extent of the compromise yet. Which of the following is the best course of action?

Correct Answer: Isolate the compromised server from the network

The best course of action is to isolate the compromised server to prevent further damage or data loss. Other actions may follow, but the primary goal is to minimize the impact on the organization.

More Incident Recovery questions
32 questions (total)
Start 32 question test