Lesson 12 - Incident Response and Monitoring Concepts

Question 1

IR

Answer 1

Incident Response

Question 2

SIEM

Answer 2

Security Information and Event Management
- A solution that provides real-time or near-real-time analysis of security alerts generated by network hardware and applications.

Question 3

SOAR

Answer 3

Security Orchestration, Automation and Response
- a set of tools and technologies that help organizations manage and respond to security threats efficiently by integrating security tools, automating tasks, and coordinating incident responses.

Question 4

CIRT

Answer 4

Computer Incident Response Team
- a specialized team responsible for detecting, containing, and responding to cyber incidents, minimizing damage and restoring normal operations

Question 5

CSIRT

Answer 5

Computer Security Incident Response Team
- a specialized group of IT professionals who are responsible for responding to and mitigating cybersecurity incidents, ensuring a swift and effective recovery while also preventing future occurrences.

Question 6

CERT

Answer 6

Computer Emergency Response Team
- a group of security experts tasked with protecting against, detecting, and responding to cybersecurity incidents.

Question 7

SOC

Answer 7

Security Operations Center
- a centralized function that monitors, detects, and responds to security incidents, employing people, processes, and technology to protect an organization’s assets.

Question 8

IRP

Answer 8

Incident Response Plan
- Specific procedures that must be performed if a certain type of event is detected or reported.

Question 9

LLR

Answer 9

Lesson Learned Report
- An analysis of events that can provide insight into how to improve response and support processes in the future.

Question 10

AAR

Answer 10

After-Action Report
- a structured document that analyzes a cybersecurity incident or exercise to identify lessons learned and areas for improvement, ultimately enhancing future preparedness and response capabilities.

Question 11

ESI

Answer 11

Electronically Stored Information
- encompassing any data held in digital form (emails, documents, databases, etc.) that can be crucial in legal matters, investigations, or compliance, requiring robust security and management.

Question 12

ARP

Answer 12

Address Resolution Protocol
- the process of connecting dynamic IP addresses to a physical machine MAC addresses.

Question 13

UTC

Answer 13

Universal Coordinated Time
- a time standard used for global synchronization of events and data, including cybersecurity incidents and logs

Question 14

EPP

Answer 14

Endpoint Protection Platform
- a suite of security technologies designed to protect endpoint devices (like laptops, desktops, and servers) from various threats, including malware, by combining multiple security functions into a single, centralized system

Question 15

MUA

Answer 15

Mail User Agent

Question 16

MDA

Answer 16

Mail Delivery Agent

Question 17

MTA

Answer 17

Message Transfer Agent

Question 18

SNMP

Answer 18

Simple Network Management Protocol
- an application-layer protocol that transmits management data between network devices.

Question 19

SCAP

Answer 19

Security Content Automation Protocol
- a framework of open standards that automates vulnerability management, measurement, and policy compliance evaluation, enabling organizations to efficiently identify, assess, and remediate security issues

Question 20

OVAL

Answer 20

Open Vulnerability and Assessment Language
- an XML schema for describing system security state and querying vulnerability reports and information.

Question 21

XCCDF

Answer 21

Extensible Configuration Checklist Description Format
- an XML schema for developing and auditing best practice configuration checklists and rules.