Automation, Orchestration, and Incident Response

Question 1

What is defined as a factor that introduced a nonconformance in an application, service, or system; the core causative issue that sets in motion the entire cause-and-effect reaction that ultimately leads to the problem?
A. Threat actor
B. Root cause
C. Kill chain
D. Threat agent

Answer 1

B. Root cause

Question 2

Which statement is TRUE when considering automation?
A. Automation systems can also be a technical debt if implemented in a rush or untested
B. Automation and scripting will often increase costs for provisioning/onboarding users and devices
C. Automation is the best solution in every use case
D. Automation is useless without orchestration

Answer 2

A. Automation systems can also be a technical debt if implemented in a rush or untested

Question 3

Which type of incident response test typically involves diagrams, floor plans, logical and virtual graphical visualizations to further eliminate gaps/errors?
A. Read-through
B. Walkthrough
C. Tabletop
D. Parallel

Answer 3

C. Tabletop

Question 4

Which is commonly used to centralize the storage and analysis of logs and other security-related documentation to perform near real-time analysis?
A. NetFlow
B. SYSLOG
C. SIEM
D. SOAR

Answer 4

C. SIEM

Question 5

What is another term used for the incident response “Detection” phase?
A. Investigation
B. Initiation
C. Identification
D. Intelligence

Answer 5

C. Identification

Question 6

In the forensic order of volatility, what would be considered the MOST volatile?
A. Temporary file systems and swap/slack space
B. CPU registers and its cache
C. Kernel statistics, tables, and caches
D. Memory (RAM)

Answer 6

B. CPU registers and its cache

Question 7

Which service involves managing several or many automated tasks or processes?
A. Orchestration
B. Scripting
C. Batching
D. Automation

Answer 7

A. Orchestration

Question 8

Which of these is a benefit of automation? Choose more than one option.
A. Faster reaction time
B. Enhanced customization
C. Enforcing baselines
D. Greater user intervention
E. Efficiency and productivity
F. Standardizing infrastructure and configuration

Answer 8

A. Faster reaction time
C. Enforcing baselines
E. Efficiency and productivity
F. Standardizing infrastructure and configuration