Discuss GIAC GCCC Exam Topic 9 Question 72

Which of the following statements is appropriate in an incident response report?

AThere had been a storm on September 27th that may have caused a power surge

BThe registry entry was modified on September 29th at 22:37

CThe attacker may have been able to access the systems due to missing KB2965111

DThe backup process may have failed at 2345 due to lack of available bandwidth

Suggested Answer: B

Get Premium GCCC Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

27 comments · newest first

Dorcas 10 months ago

C sounds a bit speculative, we need more evidence.

Rosendo 10 months ago

B is the only one with a specific timestamp, makes it reliable.

Mozelle 10 months ago

A storm could definitely cause issues, but it's not a solid fact.

Jospeh 10 months ago

D seems plausible, but lack of bandwidth? Really?

Florencia 10 months ago

Surprised that storm info is even mentioned, feels irrelevant.

Valentin 11 months ago

Option C seems a bit uncertain with "may have been able to access," which doesn't sound right for a report. I guess I should stick with option B too.

Karan 11 months ago

I think I saw a practice question that emphasized avoiding "may have" statements. So, I'm leaning towards option B again.

Matt 11 months ago

I'm not entirely sure, but I feel like mentioning specific times and actions like in option B is crucial for clarity in reports.

Whitley 11 months ago

I remember we discussed how incident reports should focus on factual information rather than speculation. I think option B is the most appropriate.

Fernanda 11 months ago

Hmm, I'm not too sure about this one. I'll need to review my notes on incident response reporting to make sure I'm choosing the right kind of information to include. Gotta be careful with these tricky exam questions.

Felice 12 months ago

I've got a good feeling about option C. Mentioning a missing security patch that may have allowed the attacker access seems like the kind of technical detail that would be important to include in an incident response.

Audry 12 months ago

I'm a bit confused on this one. The other options seem to mention general events or possibilities, but I'm not sure if those would be the most appropriate for an incident report. I'll need to think this through carefully.

Rebbecca 12 months ago

Okay, let's see here. I think option B is the most relevant - it provides a specific detail about a registry entry being modified, which could be important incident information.

Joseph 1 year ago

Hmm, this looks like a tricky one. I'll need to carefully consider each option and think about what kind of information would be appropriate in an incident response report.

Dominic 1 year ago

Haha, I bet the attacker was a meteorologist trying to cover their tracks with that storm excuse in Option A!

Doretha 1 year ago

Definitely Option B. The other options are too vague or speculative. We need to stick to the facts in the report.

Amie 1 year ago

↳ replying to Doretha

Yes, we should avoid speculation and stick to the concrete details in the report.

Paris 1 year ago

↳ replying to Doretha

I agree, Option B is the most specific and factual statement.

Lauran 1 year ago

I'm not sure, but I think statement A) about the storm causing a power surge could also be relevant in an incident response report.

Jacquline 1 year ago

I agree with Michal. Option B gives the necessary technical details that an incident response report should include.

Tess 1 year ago

I agree with Charlene, statement C makes sense because missing a critical security update could definitely lead to a security breach.

Michal 1 year ago

Option B is the most appropriate. Providing specific details about the incident, like the registry entry modification, is crucial for an incident response report.

Coral 1 year ago

↳ replying to Michal

I think option D is important too, highlighting a possible reason for the backup failure can help in addressing the issue.

Jacob 1 year ago

↳ replying to Michal

Option C is also relevant, identifying a potential vulnerability like missing KB2965111 is crucial for prevention.

Alyce 1 year ago

↳ replying to Michal

I agree, option B provides a specific detail that can help in understanding the incident better.

Arminda 1 year ago

↳ replying to Michal

I think option A is also important, mentioning a possible cause like a power surge can provide context.

Charlene 1 year ago

I think the correct statement is C) The attacker may have been able to access the systems due to missing KB2965111.

GIAC GCCC Exam - Topic 9 Question 72 Discussion