(6) Sound the Alarm: Detection and Response Flashcards
The first phase of the NIST Incident Response Lifecycle is Preparation. What are the other phases? Select three answers.
Detection and Analysis
Post-Incident Activity
Identify
Containment, Eradication, and Recovery
Detection and Analysis
Post-Incident Activity
Containment, Eradication, and Recovery
What type of process is the NIST Incident Response Lifecycle?
Cyclical
Linear
Synchronous
Observable
Cyclical
Fill in the blank: An _____ is an observable occurrence on a network, system, or device.
investigation
analysis
incident
event
event
A security professional investigates an incident. Their goal is to gain information about the 5 W’s, which include what happened and why. What are the other W’s? Select three answers.
Where the incident took place
When the incident took place
Which type of incident it was
Who triggered the incident
Where the incident took place
When the incident took place
Who triggered the incident
What are the goals of a computer security incident response team (CSIRT)? Select three answers.
To handle the public disclosure of an incident
To manage incidents
To prevent future incidents from occurring
To provide services and resources for response and recovery
To manage incidents
To prevent future incidents from occurring
To provide services and resources for response and recovery
Which document outlines the procedures to follow after an organization experiences a ransomware attack?
A security policy
A network diagram
A contact list
An incident response plan
An incident response plan
Fill in the blank: The job of _____ is to investigate alerts and determine whether an incident has occurred.
technical leads
public relations representative
incident coordinators
security analysts
security analysts
Which member of a CSIRT is responsible for tracking and managing the activities of all teams involved in the response process?
Public relations representative
Incident coordinator
Security analyst
Technical lead
Incident coordinator
What are some examples of types of documentation? Select three answers.
Alert notifications
Final reports
Policies
Playbooks
Final reports
Policies
Playbooks
Fill in the blank: Ticketing systems such as _____ can be used to document and track incidents.
Excel
Jira
Evernote
Cameras
Jira
What application monitors system activity, then produces alerts about possible intrusions?
Intrusion detection system
Playbook
Word processor
Product manual
Intrusion detection system
What actions does an intrusion prevention system (IPS) perform? Select three answers.
Detect abnormal activity
Stop intrusive activity
Manage security incidents
Monitor activity
Detect abnormal activity
Stop intrusive activity
Monitor activity
Which tool collects and analyzes log data to monitor critical activities in an organization?
Security information and event management (SIEM) tool
Intrusion prevention system (IPS) tool
Playbook
Intrusion detection system (IDS) tool
Security information and event management (SIEM) tool
Fill in the blank: Security orchestration, automation, and response (SOAR) is a collection of applications, tools, and workflows that uses automation to _____ security events.
respond to
interact with
collect
remediate
respond to
Which step in the SIEM process transforms raw data to create consistent log records?
Normalize data
Collect and aggregate data
Analyze data
Centralize data
Normalize data
What is the process of gathering data from different sources and putting it in one centralized place?
Aggregation
Notification
Analysis
Normalization
Aggregation
Which of the following is an example of a security incident?
An unauthorized user successfully changes the password of an account that does not belong to them.
A user installs a device on their computer that is allowed by an organization’s policy.
An authorized user successfully logs in to an account using their credentials and multi-factor authentication.
A software bug causes an application to crash.
An unauthorized user successfully changes the password of an account that does not belong to them.
What process is used to provide a blueprint for effective incident response?
The NIST Incident Response Lifecycle
The incident handler’s journal
The 5 W’s of an incident
The NIST Cybersecurity Framework
The NIST Incident Response Lifecycle
Which step does the NIST Incident Response Lifecycle begin with?
Preparation
Containment, Eradication and Recovery
Post-Incident Activity
Detection and Analysis
Preparation
What is a computer security incident response team (CSIRT)?
A specialized group of security professionals who focus on incident prevention
A specialized group of security professionals who are trained in incident management and response
A specialized group of security professionals who are solely dedicated to crisis management
A specialized group of security professionals who work in isolation from other departments
A specialized group of security professionals who are trained in incident management and response
Fill in the blank: Incident response plans outline the _____ to take in each step of incident response.
instructions
exercises
policies
procedures
procedures
Which of the following best describes how security analysts use security tools?
They only use documentation tools for incident response tasks.
They only use detection and management tools during incident investigations.
They only use a single tool to monitor, detect, and analyze events.
They use a combination of different tools for various tasks.
They use a combination of different tools for various tasks.
Which statement most accurately describes documentation?
It is a standardized format used to record information across all industries.
It can be audio, video, or written instructions used for a specific purpose.
It serves as legal documentation and evidence in official settings.
It is always digital and stored in a centralized database.
It can be audio, video, or written instructions used for a specific purpose.
Fill in the blank: An intrusion detection system (IDS) _____ system activity and alerts on possible intrusions.
protects
manages
analyzes
monitors
monitors
What is the difference between a security information and event management (SIEM) tool and a security orchestration, automation, and response (SOAR) tool?
SIEM tools use automation to respond to security incidents. SOAR tools collect and analyze log data, which are then reviewed by security analysts.
SIEM tools are used for case management while SOAR tools collect, analyze, and report on log data.
SIEM tools collect and analyze log data, which are then reviewed by security analysts. SOAR tools use automation to respond to security incidents.
SIEM tools and SOAR tools have the same capabilities.
SIEM tools collect and analyze log data, which are then reviewed by security analysts. SOAR tools use automation to respond to security incidents.
What happens during the data collection and aggregation step of the SIEM process? Select two answers.
Data is cleaned and transformed.
Data is centralized in one place.
Data is analyzed according to rules.
Data is collected from different sources.
Data is centralized in one place.
Data is collected from different sources.
Which core functions of the NIST Cybersecurity Framework relate to the NIST Incident Response Lifecycle? Select two answers.
Discover
Investigate
Respond
Detect
Respond
Detect
What are some roles included in a computer security incident response team (CSIRT)? Select three answers.
Technical lead
Security analyst
Incident coordinator
Incident manager
Technical lead
Security analyst
Incident coordinator
What is an incident response plan?
A document that outlines a security team’s contact information
A document that details system information
A document that contains policies, standards, and procedures
A document that outlines the procedures to take in each step of incident response
A document that outlines the procedures to take in each step of incident response
What are investigative tools used for?
Analyzing events
Managing alerts
Documenting incidents
Monitoring activity
Analyzing events
Which of the following methods can a security analyst use to create effective documentation? Select two answers.
Write documentation using technical language.
Provide clear and concise explanations of concepts and processes.
Provide documentation in a paper-based format.
Write documentation in a way that reduces confusion.
Provide clear and concise explanations of concepts and processes.
Write documentation in a way that reduces confusion.
What is the difference between an intrusion detection system (IDS) and an intrusion prevention system (IPS)?
An IDS stops intrusive activity whereas an IPS monitors system activity and alerts on intrusive activity.
An IDS monitors system activity and alerts on intrusive activity whereas an IPS stops intrusive activity.
An IDS and an IPS both have the same capabilities.
An IDS automates response and an IPS generates alerts.
An IDS monitors system activity and alerts on intrusive activity whereas an IPS stops intrusive activity.
How do indicators of compromise (IoCs) help security analysts detect network traffic abnormalities?
They capture network activity.
They confirm that a security incident happened.
They provide a way to identify an attack.
They define the attacker’s intentions.
They provide a way to identify an attack.
IoCs help security analysts detect network traffic abnormalities by providing a way to identify an attack. IoCs provide analysts with specific evidence associated with an attack, such as a known malicious IP address, which can help quickly identify and respond to a potential security incident.
Fill in the blank: Data _____ is the term for unauthorized transmission of data from a system.
infiltration
exfiltration
pivoting
network traffic
exfiltration
An attacker has infiltrated a network. Next, they spend time exploring it in order to expand and maintain their access. They look for valuable assets such as proprietary code and financial records. What does this scenario describe?
Lateral movement
Network data
Large internal file transfer
Phishing
Lateral movement
This scenario describes lateral movement. Lateral movement, also called pivoting, describes an attacker exploring a network with the goal of expanding and maintaining their access.
What can security professionals use network traffic analysis for? Select three answers.
To monitor network activity
To understand network traffic patterns
To secure critical assets
To identify malicious activity
To monitor network activity
To understand network traffic patterns
To identify malicious activity
Network traffic analysis provides security professionals with a way to monitor network activity, identify malicious activity, and understand network traffic patterns.
Which component of a packet contains the actual data that is intended to be sent to its destination?
Protocol
Footer
Header
Payload
Payload
Fill in the blank: A _____ is a file that contains data packets that have been intercepted from an interface or a network.
network protocol analyzer
protocol
packet capture
network statistic
packet capture
Which field of an IP header is used to identify whether IPv4 or IPv6 is used?
Options
Type of Service
Version
Flags
Version
Which network protocol analyzer is accessed through a graphical user interface?
Wireshark
TShark
Libpcap
tcpdump
Wireshark
