CompTIA PBQ 8 Incident Response Security+ CySA+ CASP+ SecurityX

[@jrsimeon02]

Q1: Network Intrusion 7/7 Q2: Data Breach 5/7 Q3: Ransomware Attack 6/7 Q4: Insider Threat: 6/7 Total: 24/28 86%

[@LeoCagape]

Thank you!

[@TejendraPatel-w2w]

For the insider threat question, the prompt says the insider has legitimate access, therefore, implying the insider is misusing their access. I don't understand how enforcing strict password policies or implementing RBAC would help given that the insider has legitimate access. The question could be worded differently to support those two actions IMHO. I have my sec+ 701 exam soon and your PBQ videos are very helpful!

[@jrsimeon02]

I suppose the question interprets legitimate access and authorized access as different.

[@96vintxge]

For the second question, why would you not encrypt data immediately? Wouldn't that help with future data breaches?

[@tylermisyak6445]

Preventing future data breaches is part of the Post Incident Activity Phase, which is the last phase in the IRC, so encrypting data would not be done immediately.

[@ironsilk6634]

cool