Course 6: Sound the Alarm Detection and Response

Question 1

The first phase of the NIST Incident Response Lifecycle is Preparation. What are the other phases?

Answer 1

1. Containment , Eradication and Recovery
2. Detection and Analysis
3. Post-Incident Activity

Question 2

What type of process is the NIST Incident Response Lifecycle?

Answer 2

The NIST Incident Response Lifecycle is a cyclical process. This means that phases in the lifecycle can be revisited or repeated as incident investigations progress.

Question 3

Fill in the blank: An _____ is an observable occurrence on a network, system, or device.

Answer 3

Event

Question 4

A security professional investigates an incident. Their goal is to gain information about the 5 W’s, which include what happened and why. What are the other W’s?

Answer 4

1. Where the incident took place
2. Who triggered the incident
3. When the incident took place