Unit 6 - Module 1 - Incident Response Flashcards
What do you call an observable occurrence on a network, system, or device?
An Event
What is a form of documentation used in incident response?
Incident Handler’s Journal
What incident responce process is cyclical?
NIST Incident Responce
What do you call a specialized group of security professionals that are trained in incident management and responce?
Computer Security Incident Response Teams ( CSIRT )
What framework are these 4 phases?
Preparation
Detection and Analysis
Containment, Eradication, and Recovery
Post-Incident Activity
NIST Framework
What are the 3 Important thing incident responce teams need?
3 C’s
Command
Control
Communication
What security responce teams usually have these 3 roles?
Security Analyst
Technical Lead
Incident Coordinator
CSIRT ( Computer Security Incident Responce Team )
What do you call a document that outlines the procedures to take in each step of incident response?
Incident Responce Plan
What is any form of recorded content that is used for a specific purpose?
Documentation
What is a manual that provides details about any operational action?
Playbook
What is an application that monitors system and network activity and produces alerts on possible intrusions?
Intrusion detection system (IDS)
What is an application that monitors system activity for intrusions and take action to stop the activity?
Intrusion prevention system (IPS)
What do you call an alert that correctly detects the presence of an attack?
A True Positive
What do you call a state where there is no detection of malicious activity. This is when malicious activity exists and no alert is triggered.
A True Negative
What is an alert that incorrectly detects that presence of a threat? This is when an IDS identifies an activity as malicious, but it isn’t. False positives are an inconvenience for security teams because they spend time and resources investigating an illegitimate alert.
A False Positive
