14 - Incident Response

Question 1

The Security+ Incident Response Cycle includes what six continuous steps?

Answer 1

Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned

Question 2

Michael wants to log directly to a database while also using TCP and TLS to protect his log information and to ensure that it is received. What tool should he use?

Answer 2

Syslog-ng

Question 3

What tool is specifically designed to support incident responders by allowing unified automated responses across an organization?

Answer 3

Security Orchestration, Automation, and Response (SOAR)

Question 4

Selah is following the Cyber Kill Chain model and has completed the delivery phase. What setup is next, according to the Kill Chain?

Answer 4

Exploitation

Question 5

What is the primary concern with SFlow in a large, busy network?

Answer 5

SFlow samples only network traffic, meaning that some detail will be lost

Question 6

Mark unplugs the network connection from a system that is part of an incident and places tape over its Ethernet jack with a sign that says: NO NOT RECONNECT WITHOUT APPROVAL FROM IR TEAM. How is this method best described?

Answer 6

Isolation

Question 7

As a part of their yearly incident response preparations, Ben’s org goes through a sample incident step by step to validate what each person will do in the incident. What type of exercise is this?

Answer 7

A Walk-through Exercise

Question 8

Madhuri wants to check a PNG-formatted photo for GPS coordinates. Where can she find that information if it exists in the photo?

Answer 8

In the photo’s Metadata

Question 9

Alyssa wants to prevent a known Microsoft Word file from being downloaded and accessed on devices she is responsible for. What type of tool can she use to prevent this?

Answer 9

A Deny List Tool

Question 10

Which of the following is NOT one of the phases in COOP?

• Readiness and Preparedness
• Activation and Relocation
• Continuity of Operations
• Documentation and Reporting

Answer 10

Documentation and Reporting is not a step in Continuity of Operations Planning (COOP) - the fourth phase is Reconstitution

Question 11

Ian has been receiving hundreds of false positive alerts from his SIEM every night when scheduled jobs run across his datacenter. What rate should he adjust on his SIEM to reduce the false positive rate?

Answer 11

The Sensitivity Rate

Question 12

Which team member acts as a primary conduit to senior management on an IR team?

Answer 12

Management

Question 13

Gwen is building her org’s documentation and processes and wants to create the plan for what the org would do if her datacenter burned down. What type of plan would typically cover that type of scenario?

Answer 13

A Disaster Recovery Plan (DR Plan)

Question 14

Megan’s org uses the Diamond Model of Intrusion Analysis as part of their incident response process. A user in Megan’s org has discovered a compromised system. What core feature would help her determine how the compromise occurred?

Answer 14

Capability

Question 15

Jim wants to view log entries that describe actions taken by applications on a CentOS Linux system. Which of the following tools can he use on the system to view those logs?

• logger
• syslog-ng
• journalctl
• tail

Answer 15

journalctl

Question 16

Chris has turned on logon auditing for a Windows system. What log will show them?

Answer 16

The Windows Security Log

Question 17

Susan has discovered that an incident took place on her network almost six months ago. As she prepares to identify useful data for the incident, which common policy is most likely to cause her difficulties during her investigation?

Answer 17

Any Retention Policies

Question 18

Hitesh wants to keep a system online but limit the impact of the malware that was found on it while an investigation occurs. What method from the following list should he use?

• Containment
• Isolation
• Segmentation
• Black Holing

Answer 18

Containment

Question 19

What phase in the incident response process leverages indicators of compromise and log analysis as part of a review of events?

Answer 19

Identification

Question 20

Henry wants to check to see if services were installed by an attacker. What commonly gathered organizational data can he use to see if a new service appeared on systems?

Answer 20

Vulnerability Scans