Chapter 8 Implementing Incident Response and Forensics Flashcards
During a security incident, a team member was able to refer to known documentation and databases of attack vectors to aid the response. What is this an example of?
A. Event classification
B. A false positive
C. A false negative
D. A true positive
A. Event classification
During a security incident, a team member responded to a SIEM alert and successfully stopped an attempted data exfiltration. What can be said about the SIEM alert?
A. It is a false positive
B. It is a false negative
C. It is a true positive
D. It is a true negative
C. It is a true positive
During a security incident, a senior team leader coordinated with members already dealing with a breach. They were told to concentrate their efforts on a new threat. What process led to the team leaders actions?
A. Preparation
B. Analysis
C. Triage event
D. Pre-escalation tasks
C. Triage event
A CSIRT team needs to be identified, including leadership with a clear reporting and escalation process. At what stage of the incident response process should this be done?
A. Preparation
B. Detection
C. Analysis
D. Containment
A. Preparation
During a recent security incident, a team member responded to a SIEM alert stating that multiple workstations on a network segment have been infected with crypto malware. What part of the incident process should be followed?
A. Preparation
B. Detection
C. Analysis
D. Containment
D. Containment
After a security incident, workstations that were previously infected with crypoto malware were placed in quarantine, wiped and successfully scanned with an updated antivirus. What part of the incident response process should be followed?
A. Analysis
B. Containment
C. Recovery
D. Lessons Learned
C. Recovery
During a security incident, multiple systems were impacted by a DDOS attack. To mitigate the effect of the attack, a CSIRT team member follows procedures to trigger a BGP route update. This deflects the attack and the systems remain operation. What documentation did the CSIRT team member refer to?
A. Communication
B. Runbooks
C. Configuration guides
D. Vendor documentation
B. Runbooks
Critical infrastructure has been targeted by attackers who demand large payments in bitcoin to reveal the technology and keys needed to access the encrypted data. To avoid paying the ransom, analysts have been tasked to crack the cypher. What technique will they use?
A. Ransomware
B. Data exfiltration
C. Cryptanalysis
D. Steganalysis
C. Cryptanalysis
During a security incident, multiple systems were impacted by a DDoS attack. A security professional working in the SOC can view the events on a reporting dashboard and call up automated scripts to mitigate the attack. What system was used to respond to the attack?
A. Containment
B. SOAR
C. Communication Plan
D. Configuration guides
B. SOAR
A technician who is part of the IRT is called to take a forensic copy of a hard drive on the CEO’s laptop. He takes notes of the step by step process and stores the evidence in a locked cabinet in the CISO’s office. What will make this evidence inadmissible?
A. Evidence collection
B. Lack of chain of custody
C. Missing order of volatility
D. Missing memory snapshots
B. Lack of chain of custody
A forensic investigator is called to capture all the possible evidence from a compromised laptop. To save battery life, the system is put into sleep mode. What important forensic process has been overlooked?
A. Cloning
B. Evidence preservation
C. Secure storage
D. Backups
B. Evidence preservation
A forensic investigator is called to capture all possible evidence from a compromised computer that has been switched off. They gain access to the hard drive and connect a write blocker before recording the current hash value of the hard drive image. What important forensic process has been followed?
A. Integrity preservation
B. Hashing
C. Cryptanalysis
D. Steganalysis
A. Integrity preservation
Law enforcement needs to retrieve graphic image files that have been deleted or hidden in unallocated space on a hacker’s hard drive. What tools should they use when analyzing the captured forensic image?
A. File carving tools
B. objdump
C. strace
D. netstat
A. File carving tools
FBI forensics experts are investigating a new variant of APT that has replaced Linux operating system files on government computers. What tools should they use to understand the behavior and logic of these files?
A. Runbooks
B. Binary analysis tools
C. Imaging tools
D. vmstat
B. Binary analysis tools
A forensic investigator suspects stolen data is hidden within JPEG images on a suspectts computer. After capturing a forensic image, what techniques should they use when analyzing the JPEG image files?
A. Integrity preservation
B. Hashing
C. Cryptanalysis
D. Steganalysis
D. Steganalysis
