6. Sound the alarm: detection and response

Question 1

Computer security incident response teams (CSIRT)

Answer 1

specialized group of security professionals that are trained in incident management and response

Question 2

Documentation

Answer 2

any form of recorded content that is used for a specific purpose

Question 3

Endpoint detection and response EDR

Answer 3

application that monitors an endpoint for malicious activity

Question 4

Event

Answer 4

observable occurrence on a network, system, or device

Question 5

False negative

Answer 5

state where the presence of a threat is not detected

Question 6

False positive

Answer 6

alert that incorrectly detects the presence of a threat

Question 7

Incident

Answer 7

occurrence that actually or imminently jeopardizes, without lawful authority, the confidentiality, integrity, or availability of info or an info system; or constitutes a violation or imminent threat of violation of law, security policies, a security procedures, or acceptable uses policies

Question 8

Incident handler’s journal

Answer 8

form of documentation used in incident response

Question 9

Incident response plan

Answer 9

document that outlines the procedures to take in each step of incident response

Question 10

Incident detection system IDS

Answer 10

application that monitors system activity and alerts on possible intrusions

Question 11

Intrusion prevention system IPS

Answer 11

application that monitors system activity for intrusive activity and takes action to stop the activity

Question 12

National Institute of Standards and Technology NIST Incident Response Lifecycle

Answer 12

framework for incident response consisting of four phases: preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity

Question 13

Playbook

Answer 13

manual that provides details about any operational action

Question 14

Security information and event management SIEM

Answer 14

application that collects and analyzes log data to monitor critical activities in an org

Question 15

Security operations center SOC

Answer 15

org unit dedicated to monitoring networks, systems, and devices for security threats or attacks

Question 16

Security orchestration, automation, and response SOAR

Answer 16

collection of applications, tools, and workflows that uses automation to respond to security events

Question 17

True negative

Answer 17

state where there is no detection of malicious activity

Question 18

True positive

Answer 18

alert that correctly detects the presence of an attack