Free PECB ISO/IEC 27035 Foundation Practice Questions

Sample Practice Questions

Try these 10 sample questions from the PECB ISO/IEC 27035 Foundation practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1Which condition must an adverse cybersecurity event meet?

   1. A.It must involve an identified malicious actor.
   2. B.It must have a potentially negative impact on cybersecurity.Correct answer: B
   3. C.It must have caused a confirmed breach of confidentiality.
   4. D.It must involve a proven violation of security policy.

   Explanation: NIST defines an adverse cybersecurity event as "Any event with a potentially negative impact on cybersecurity." Potential harm is required; a confirmed breach, policy violation, or identified attacker is not.

   Reference: Incident Response Recommendations and Considerations for Cybersecurity Risk Management — Appendix B, adverse cybersecurity event, p. 39

2. 2A team wants to recognize unusual network behavior during incident detection. What preparation directly supports this?

   1. A.Recording only the abnormal traffic from a past incident
   2. B.Documenting a baseline of normal network activityCorrect answer: B
   3. C.Using a single incident alert as the normal traffic profile
   4. D.Treating all network traffic as suspicious without a normal reference

   Explanation: CISA states, "Establishing baselines enables defenders to identify deviations." A documented view of normal activity supports this comparison.

   Reference: Cybersecurity Incident & Vulnerability Response Playbooks — Incident Response Playbook, Preparation Phase, p. 6

3. 3What is a vulnerability in the context of information security incidents?

   1. A.An observable record that suggests an attack may have occurred
   2. B.A weakness that can be exploited or triggered to disrupt securityCorrect answer: B
   3. C.A circumstance capable of causing harm through an information system
   4. D.An occurrence that actually or imminently jeopardizes information

   Explanation: NIST describes a vulnerability as "A weakness in a system, system security procedures, internal controls, or implementation" that an actor or event can exploit or trigger. The other options describe an indicator, a threat, and an incident, respectively.

   Reference: Incident Response Recommendations and Considerations for Cybersecurity Risk Management — Appendix B, vulnerability, p. 39

4. 4During an incident, the organization's production communication systems may be monitored by an attacker. What should a recovery plan provide for coordinating response?

   1. A.The potentially monitored production email system
   2. B.The production chat service that may have been compromised
   3. C.An alternative communication channel independent of production systemsCorrect answer: C
   4. D.A public discussion channel for confidential incident updates

   Explanation: NIST describes out-of-band communication as communication with stakeholders "without using existing production systems, which are frequently monitored by advanced adversaries." An independent channel can reduce reliance on compromised production systems.

   Reference: Guide for Cybersecurity Event Recovery — Section 2.3.1, Out of band communications, p. 8

5. 5What is the role of an indicator of compromise in incident analysis?

   1. A.It confirms the identity of the attacker responsible.
   2. B.It proves the full scope of the compromise.
   3. C.It suggests that an attack or compromise may have taken place.Correct answer: C
   4. D.It establishes that a vulnerability has been exploited.

   Explanation: NIST describes indicators of compromise as "Technical artifacts or observables that suggest that an attack is imminent or is currently underway or that a compromise may have already occurred." An indicator suggests a possibility; it does not prove the extent of compromise.

   Reference: Incident Response Recommendations and Considerations for Cybersecurity Risk Management — Appendix B, indicators of compromise, p. 39

6. 6Before using backups to restore an incident-affected system, what should responders check?

   1. A.Whether it is the newest copy, without checking integrity
   2. B.Whether the backup is free of compromise and integrity problemsCorrect answer: B
   3. C.Whether it is the oldest copy, without checking integrity
   4. D.Whether it has the expected filename, without checking its contents

   Explanation: NIST recommends, "Check restoration assets for indicators of compromise, file corruption, and other integrity issues before use." This reduces the chance of restoring untrusted or damaged data.

   Reference: Incident Response Recommendations and Considerations for Cybersecurity Risk Management — Table 3, RC.RP-03, p. 34

7. 7How does an incident response procedure relate to an incident response policy?

   1. A.The policy is a record of actions; the procedure sets organization-wide objectives.
   2. B.The policy prescribes technical steps; the procedure states management commitment.
   3. C.The procedure supersedes the policy; the policy supports the procedure.
   4. D.The procedure describes how activities are performed under the policy.Correct answer: D

   Explanation: NIST states that "Processes and procedures should be based on the incident response policy and plan." It also explains that documented procedures describe how processes are performed, so the policy and procedure have distinct roles.

   Reference: Incident Response Recommendations and Considerations for Cybersecurity Risk Management — Section 2.3, p. 9

8. 8A messaging service depends on an authentication service. How should this dependency affect incident recovery planning?

   1. A.Exclude authentication services from the recovery plan because they support other systems.
   2. B.Always restore the messaging service first because it is directly user-facing.
   3. C.Treat both services as independent when setting their restoration sequence.
   4. D.Consider restoring the authentication service before the dependent messaging service.Correct answer: D

   Explanation: NIST states that "it is frequently necessary to recover an identity or authentication server before recovering files, messaging services, and data". Dependencies inform the order, with the actual plan reflecting the organization's environment.

   Reference: Guide for Cybersecurity Event Recovery — Section 2.1, Enterprise Resiliency, p. 5

9. 9What is the main purpose of an incident response playbook?

   1. A.To establish the organization's overall incident response policy
   2. B.To record the factual timeline of a completed incident
   3. C.To provide actionable steps for particular situationsCorrect answer: C
   4. D.To summarize the trends across a register of incidents

   Explanation: NIST states that "Playbooks provide actionable steps or tasks for people to perform during various scenarios or situations." A playbook guides actions for a situation; it is distinct from a policy or a record of completed incidents.

   Reference: Incident Response Recommendations and Considerations for Cybersecurity Risk Management — Section 2.3, p. 9

10. 10An alert shows remote administration activity during a scheduled maintenance window. What should an analyst check to avoid misclassifying authorized work as an incident?

    1. A.Whether the maintenance window exists, without comparing the activity
    2. B.Whether the observed activity matches the authorized maintenanceCorrect answer: B
    3. C.Whether a remote tool was used, without checking its authorization
    4. D.Whether a log entry exists, without checking the maintenance details

    Explanation: CISA recommends procedures to "deconflict potential incidents with authorized activity" and gives remote administration for updates as an example. Comparing the alert with authorized maintenance helps determine whether it reflects an incident.

    Reference: Cybersecurity Incident & Vulnerability Response Playbooks — Incident Response Playbook, Detection & Analysis, p. 10