Assessing Corporate Cybersecurityintermediate
In the CodeForge incident response tabletop exercise, arrange the timed scenario injects in the chronological order in which they are introduced (from T+0 to T+60).
Answer
Missing access logs and outdated data-retention policies are identified., A client requests GDPR documentation within 48 hours., SOC 2 auditors announce an on-site visit., A whistleblower reports developers using personal GitHub accounts for client code., A data protection authority issues a preliminary inquiry.
Explanation
### The order
1. **Missing access logs and outdated data-retention policies are identified.** These are the initial concerns at T+0.
2. **A client requests GDPR documentation within 48 hours.** This is introduced at T+15.
3. **SOC 2 auditors announce an on-site visit.** This is introduced at T+30.
4. **A whistleblower reports developers using personal GitHub accounts for client code.** This is introduced at T+45.
5. **A data protection authority issues a preliminary inquiry.** This is introduced at T+60.
### The concept
The sequence matters because the exercise tests how the team updates its response as new pressures and facts arrive. The timing is part of the scenario and should not be treated as a general model of real-world incident timing.
### Terms
- **T+0**: The starting point of the exercise timeline.
- **T+15, T+30, T+45, T+60**: Time markers showing when later injects are introduced.
- **GDPR**: General Data Protection Regulation, a European Union regulation concerning personal data and its processing.
- **SOC 2**: Service Organization Control 2, an audit and reporting framework concerning controls at service organizations.
### Remember
Read timed injects in sequence, then reassess the response as the scenario develops.
Related Questions
- Outsourcing payment processing to a third-party vendor completely transfers all regulatory compliance and data protection responsibilities away from the hiring organization.(intermediate)
- In an incident management exercise divided into discovery, investigation, response, and recovery, the phase focused on analyzing logs, alerts, and evidence to examine unauthorized activity is called _____.(basic)
- The recovery and compliance review phase can include a mock audit, ongoing monitoring, staff training, and improvements informed by the incident.(basic)
- A staff member accesses the billing system from an unprotected personal laptop, and suspicious activity alerts appear. Which response area is most directly implicated by this new information?(intermediate)
- During a tabletop incident response exercise involving potential payment card data compromise, which activity is the primary focus of the Discovery phase?(advanced)
Want to practice more questions like this?
Join myBenkio free and practice past questions for your Nigerian university courses with AI explanations for every answer.
Start Practicing Free