Incident Response and Organization

On a business PC, the antivirus software shows a warning that it has “detected malware,” and the PC's behavior has also become unstable. What should the user do first?

1. Delete all of the antivirus software's detection history and warning logs so the warning stops appearing
2. Disconnect the PC from the network, for example by unplugging the LAN cable or turning off Wi-Fi
3. Press and hold the power button to immediately turn the PC off
4. Search the internet on their own for a removal tool, download it, run it, and try to remove the malware themselves

For a device suspected of malware infection, the rule is to disconnect it from the network without turning off the power. Which of the following is the most appropriate reason for this?

1. To preserve volatile information, such as data in memory and the state of network connections, that would be lost if the power were turned off, so it can be used for investigating the cause
2. Because turning off the power would cause every file on the hard disk to be encrypted
3. Because turning off the power would reset the antivirus software's definition files
4. Because turning off the power would act as a signal that automatically spreads the malware across the internal network

Under JIS Q 27000, which of the following most appropriately describes the relationship between an information security event and an information security incident?

1. An incident refers to a minor, everyday occurrence, and only the subset with a large enough loss to require reporting to management is separately called an event.
2. An event refers only to something caused by an attack from outside the organization, and an incident refers only to something caused by an internal person violating a regulation.
3. Event and incident are synonyms, differing only in which term is used when writing a report.
4. An event indicates the occurrence of something related to security, and among these, the ones judged highly likely to compromise business operations and threaten information security are incidents.

Which of the following correctly orders the stages of incident response in their typical sequence?

1. Analysis and investigation → detection and intake → reporting → initial response (triage) → prevention of recurrence → containment and recovery
2. Detection and intake → analysis and investigation → prevention of recurrence → initial response (triage) → containment and recovery → reporting
3. Detection and intake → initial response (triage) → analysis and investigation → containment and recovery → reporting → prevention of recurrence
4. Initial response (triage) → detection and intake → containment and recovery → prevention of recurrence → analysis and investigation → reporting

An employee opened an attachment from an email disguised as coming from a business partner. Nothing seemed to happen right after opening it, but the employee grew uneasy. What should this employee do first?

1. To find out whether the email was really suspicious, send an inquiry email to the sender's address and wait for a reply
2. Just to be sure, open the attachment again and carefully check every last detail themselves for anything unusual
3. Disconnect the device from the network and immediately report it to their supervisor and the information security team (CSIRT)
4. Since nothing in particular happened after opening the attachment, wait and see for a while, and only report it to the contact point once something abnormal appears

Which of the following most appropriately describes triage in incident response?

1. Quickly estimating the scope of impact and the urgency of a reported case, and deciding the priority and who will handle it
2. Taking time to identify the root cause of an incident and deciding and carrying out a permanent measure to prevent recurrence
3. Having each department's staff member confirm, one by one, that operations have returned to normal after recovery
4. Confirming, using hash values, that collected evidence has not been altered along the way, and recording that confirmation

An employee realizes that an email with a customer list attached was sent to the wrong recipient, a different outside company. What should be done first?

1. Call the recipient themselves to explain the situation, and if they promise to delete it, skip reporting the matter internally
2. Record the facts — the recipient, the time sent, and the content of the attachment — and immediately report it to their supervisor and the information security officer
3. Delete the email from their own Sent folder so that no record of it having been sent remains anywhere inside the company
4. To avoid causing trouble for customers, call every affected customer to apologize before telling their supervisor

Which of the following most appropriately describes the difference between incident management and problem management?

1. Incident management aims to identify the root cause and prevent recurrence, while problem management aims to apply a temporary workaround.
2. Incident management aims to restore the service as quickly as possible, while problem management aims to identify the root cause and prevent recurrence.
3. Incident management is carried out by management, and problem management by the frontline department — the difference is who is in charge.
4. Incident management deals only with information security cases, and problem management deals only with system failures.

An employee notices they have lost a company-issued laptop containing customer information while out of the office. What should this employee do first?

1. Since there is a chance it will turn up, look for it on their own that day and only report it the next morning if it is not found
2. Note the time and circumstances of noticing the loss, and immediately contact their supervisor and the information security team
3. First file a report with the nearest police station, and report it internally only if it is never found
4. Contact the customer on their own judgment and inform them first that there is a possibility their information has leaked

A staff member reviewing server logs found a record showing repeated login attempts on an administrator account late at night, with one of them succeeding. What should be done first?

1. Just reinitialize the server for now, restore it from backup, and continue business as usual
2. Preserve the relevant log (save it so it cannot be overwritten) and report it to the CSIRT and their supervisor
3. Since the log entries are confusing, delete the relevant lines to tidy it up and make it easier to read
4. Connect on their own to the IP address that appears to be the source of the attack, investigate that party's system, and prepare to retaliate

Which of the following is the most appropriate way to carry out evidence preservation in digital forensics?

1. Delete unnecessary files that would get in the way of analysis first, and narrow down the target before making a copy
2. Analyze the original target disk directly, and extract and save only the files that are needed
3. Since the investigation takes time, keep working across a rotation of staff members without keeping any record
4. Make a copy of the target disk, demonstrate that it is identical using a hash value, and then analyze the copy

Which of the following is the most appropriate role for a CSIRT set up within a company?

1. Accepting incident reports through a single contact point, deciding the triage and response policy, and coordinating communication both inside and outside the company
2. Auditing the company's information systems and, from an independent standpoint, submitting an audit report to management with recommendations for improvement
3. Taking on the development of information systems and handling everything from designing and implementing security functions through to maintenance after deployment
4. Continuously monitoring employees' work attendance and disciplining anyone who violates work rules

Which of the following most appropriately describes the difference in roles between a CSIRT and a SOC?

1. A SOC handles only recovery work after an incident has occurred, and a CSIRT handles only the ongoing monitoring of logs and alerts during normal times, staying out of response coordination.
2. A SOC is responsible for reporting to management and handling public relations, and a CSIRT is responsible only for changing equipment configuration.
3. A SOC detects and analyzes signs of attack through continuous monitoring of logs and alerts, and a CSIRT decides the response policy for a detected case and coordinates it inside and outside the company.
4. A SOC responds to vulnerabilities in the products the company itself provides, and a CSIRT handles only inquiries from outside the company.

Which of the following most appropriately describes a PSIRT?

1. A team that continuously monitors a company's own internal network and servers 24 hours a day, detecting communication anomalies at an early stage
2. An organization in which member companies within an industry bring threat information together, analyze it, and share the results widely among member companies
3. A team that accepts vulnerability information about the products or services a company itself provides, and handles releasing fixes and notifying customers
4. An organization that formulates a government-wide cybersecurity strategy and defines and publishes unified standards each ministry must follow

Which domestic organization accepts incident reports, coordinates among the parties involved, liaises with CSIRTs overseas, and issues alerts?

1. ISMS-AC
2. NISC
3. the Personal Information Protection Commission
4. JPCERT/CC

Which of the following most appropriately describes the activity of J-CRAT?

1. Gathering vulnerability countermeasure information and publishing it for users on a portal site
2. Receiving consultations from organizations suspected of having suffered a targeted attack, and supporting them in stopping the damage from spreading and responding early
3. Accrediting certification bodies for information security management systems
4. Anonymizing information about targeted attacks that participating organizations bring together and sharing it, helping other organizations notice threats early

You have found an undisclosed vulnerability in a software product your company uses. Which of the following is the most appropriate way to handle it under the Information Security Early Warning Partnership?

1. To check whether it can actually be exploited, try it out on another company's server that runs the same publicly available product.
2. Report the vulnerability information to IPA and wait for JPCERT/CC to coordinate with the developer and arrange disclosure.
3. If it does not affect your own company, keep it entirely in-house, take countermeasures internally, and tell no one.
4. To warn users of the danger immediately, publish the details of the vulnerability and how to reproduce it on social media right away.

Which of the following most appropriately describes SIEM?

1. A mechanism that centrally aggregates logs from various devices and software and detects, through correlation analysis, signs of an attack that would not be noticed from any single log alone
2. A mechanism that encrypts communication content so that even if it is intercepted in transit, it cannot be read
3. A mechanism that replicates important data to a remote site so that operations can resume quickly and continue even after a disaster
4. A mechanism that forces device users to change their password periodically and bans reuse across other services

Which of the following most appropriately describes a tabletop exercise held to prepare for an information security incident?

1. A drill in which the system is actually taken offline, recovery work is carried out step by step in the production environment, and the time taken is measured and recorded
2. A drill in which training emails are sent to all users at once, tallying how many people opened them and how many reported them to the contact point
3. A drill in which an assumed damage scenario is presented on paper and the people involved gather to walk through the flow of decisions and communication, uncovering gaps in the procedure
4. An assessment in which outside experts actually attempt an attack to test whether they can break into the system, and report the results

A staff member in the sales department notices a case in which a file containing customers' personal data may have leaked outside. What should this staff member do first?

1. Follow the reporting route defined in internal regulations and immediately report it to the personal information protection manager or the information security officer
2. Investigate it within the department alone, and report it internally only once it becomes certain that a leak occurred
3. Since it is not yet confirmed whether a leak occurred, individually contact the customers who might be affected to check
4. Call the Personal Information Protection Commission directly under their own name to explain the situation, and report to their internal supervisor only after receiving the Commission's instructions

Regarding reporting a personal data leak to the Personal Information Protection Commission, which of the following is most appropriate?

1. Submit a preliminary report promptly after becoming aware of the situation, and submit the final report in principle within 30 days (within 60 days for a situation suspected of having been carried out with wrongful intent)
2. There is no need to submit either a preliminary or a final report until the investigation is finished and the cause and scope are confirmed; a single combined report can be submitted afterward
3. Reports are accepted only in writing and must be submitted to the Personal Information Protection Commission within three months of becoming aware of the situation
4. There is no distinction between a preliminary and a final report; a single report covering everything is submitted within one year of becoming aware of the situation

Among cases of a personal data leak, which of the following is not a situation for which reporting to the Personal Information Protection Commission is mandatory?

1. A situation in which personal data containing credit card numbers leaked, creating a risk of financial harm from fraudulent use
2. A situation in which personal data held by the organization may have been taken outside due to unauthorized access from outside
3. A situation in which personal data containing special-care-required personal information, such as an employee's medical history, leaked outside
4. A situation in which an internal-only product development document was mistakenly sent outside, but it contained no personal data

Regarding notifying the affected individuals when a personal data leak occurs, which of the following is most appropriate?

1. Notifying the individuals is merely a best-effort goal, so deciding in advance through internal regulations not to notify them means nothing needs to be done at all, including a public announcement or an inquiry desk
2. Notify them promptly depending on the circumstances of the situation, but when notification is difficult, for example because contact information is unknown, alternative measures such as a public announcement or setting up an inquiry desk may be taken instead
3. The individuals may not be notified until after the final report has been submitted to the Personal Information Protection Commission and its content confirmed
4. As long as the report to the Personal Information Protection Commission is submitted within the deadline, notifying the individuals becomes unnecessary across the board

Regarding the independence of a systems auditor, which of the following is most appropriate?

1. An auditor must personally carry out the improvement work for a finding they raised, and personally confirm the result
2. An auditor must not audit an information system in whose design, development, or operation they themselves were involved
3. An auditor may audit the department they are being audited in while also handling that department's day-to-day work as one of its members
4. An auditor must be independent of management and must not submit the audit report to management

Regarding how a systems audit should proceed, which of the following is most appropriate?

1. Because the auditor's own impression matters most, skip the work of gathering objective evidence such as an audit trail
2. Carry out the main survey first to gather facts, and only afterward draw up the audit plan and audit procedures to match what was found
3. The audit is complete once the audit report is submitted to management, so the follow-up that later confirms whether the raised findings were improved is omitted
4. Draw up an audit plan, grasp the overview through a preliminary survey, carry out the main survey, go through evaluation and conclusions, submit a report, and then confirm the improvement status through a follow-up