WGU D483 CERTIFICATION PREP STUDY
GUIDE GUARANTEED TO PASS
◉ What should the incident response team do FIRST after an
incident is confirmed?
Answer: Perform an impact assessment to determine scope,
severity, and who must be involved.
◉ What is the PRIMARY goal of mitigation?
Answer: Contain the incident and prevent additional damage.
◉ What is the difference between recovery and remediation?
Answer: Recovery restores normal operations; remediation fixes
weaknesses to prevent recurrence.
◉ When should incident reporting occur?
Answer: Throughout the incident response process, with formal
reporting after mitigation as appropriate.
◉ A hospital detects ransomware spreading between clinical
workstations. The security team disconnects affected systems
from the network. Which phase is this?
Answer: Mitigation because the team is containing further
damage.
, ◉ After containing the ransomware, the hospital restores clean
systems from backups and returns clinical applications to service.
Which phase is this?
Answer: Recovery.
◉ The hospital later patches the exploited vulnerability and
changes its security controls. Which phase is this?
Answer: Remediation.
◉ A retailer discovers suspicious outbound traffic. Before
isolating systems, the IR team determines which servers and
customer records are affected. What is the team performing?
Answer: Impact assessment during the response phase.
◉ A manufacturer has not yet experienced an incident but creates
an IR plan, assigns team roles, and conducts exercises. Which
phase is this?
Answer: Preparation.
◉ A company's executives, legal counsel, customers, and
regulators all request incident updates. What is the BEST way to
maintain consistent communication?
Answer: Designate a single authorized point of contact for
reporting.
◉ Which action is LEAST appropriate during mitigation?
GUIDE GUARANTEED TO PASS
◉ What should the incident response team do FIRST after an
incident is confirmed?
Answer: Perform an impact assessment to determine scope,
severity, and who must be involved.
◉ What is the PRIMARY goal of mitigation?
Answer: Contain the incident and prevent additional damage.
◉ What is the difference between recovery and remediation?
Answer: Recovery restores normal operations; remediation fixes
weaknesses to prevent recurrence.
◉ When should incident reporting occur?
Answer: Throughout the incident response process, with formal
reporting after mitigation as appropriate.
◉ A hospital detects ransomware spreading between clinical
workstations. The security team disconnects affected systems
from the network. Which phase is this?
Answer: Mitigation because the team is containing further
damage.
, ◉ After containing the ransomware, the hospital restores clean
systems from backups and returns clinical applications to service.
Which phase is this?
Answer: Recovery.
◉ The hospital later patches the exploited vulnerability and
changes its security controls. Which phase is this?
Answer: Remediation.
◉ A retailer discovers suspicious outbound traffic. Before
isolating systems, the IR team determines which servers and
customer records are affected. What is the team performing?
Answer: Impact assessment during the response phase.
◉ A manufacturer has not yet experienced an incident but creates
an IR plan, assigns team roles, and conducts exercises. Which
phase is this?
Answer: Preparation.
◉ A company's executives, legal counsel, customers, and
regulators all request incident updates. What is the BEST way to
maintain consistent communication?
Answer: Designate a single authorized point of contact for
reporting.
◉ Which action is LEAST appropriate during mitigation?
