CAP Incident Response & Recovery 2 — Questions and Answers
Question 1: Which NIST SP 800-61 phase involves preserving evidence and limiting the scope of a security incident?
- Preparation
- Detection and Analysis
- Containment, Eradication, and Recovery (Correct answer)
- Post-Incident Activity
Correct answer: Containment, Eradication, and Recovery
The Containment, Eradication, and Recovery phase focuses on stopping the spread of an incident and preserving evidence while restoring systems.
Question 2: During incident response, what is the primary purpose of a chain of custody document?
- To track system uptime during recovery
- To ensure evidence integrity and admissibility (Correct answer)
- To assign roles to incident response team members
- To document lessons learned after the incident
Correct answer: To ensure evidence integrity and admissibility
Chain of custody documents track who handled evidence and when, ensuring its integrity and legal admissibility.
Question 3: A security analyst notices anomalous outbound traffic to an unknown IP address. According to NIST SP 800-61, this falls into which incident category?
- Denial of Service
- Malicious Code (Correct answer)
- Unauthorized Access
- Inappropriate Usage
Correct answer: Malicious Code
Anomalous outbound traffic to unknown IPs is typically indicative of malicious code (e.g., malware beaconing to a C2 server).
Question 4: In the context of FedRAMP incident reporting, what is the required timeframe for reporting a major incident to US-CERT?
- Within 1 hour (Correct answer)
- Within 24 hours
- Within 48 hours
- Within 72 hours
Correct answer: Within 1 hour
FedRAMP requires cloud service providers to report major security incidents to US-CERT within one hour of discovery.
Question 5: What is the key difference between a security 'event' and a security 'incident' under NIST SP 800-61?
- Events are internal; incidents are external
- An incident adversely affects information or systems, while an event is any observable occurrence (Correct answer)
- Events require reporting; incidents do not
- Incidents are technical; events are administrative
Correct answer: An incident adversely affects information or systems, while an event is any observable occurrence
An event is any observable occurrence in a system, while an incident is an event that actually or potentially jeopardizes confidentiality, integrity, or availability.
Question 6: Which containment strategy involves isolating a compromised system while keeping it running to gather additional intelligence?
- Short-term containment
- System imaging
- Forensic containment
- Long-term containment (Correct answer)
Correct answer: Long-term containment
Long-term containment allows a compromised system to remain operational in isolation so analysts can observe attacker behavior and gather intelligence.
Question 7: After eradicating a threat and restoring systems, which activity is critical before returning systems to full production?
- Notifying all users of the incident
- Updating the system security plan
- Vulnerability scanning and validation testing (Correct answer)
- Archiving all incident logs
Correct answer: Vulnerability scanning and validation testing
Vulnerability scanning and validation testing confirm that the threat has been completely removed and no residual vulnerabilities remain before systems go back into production.
CAP Incident Response & Recovery 2
Which NIST SP 800-61 phase involves preserving evidence and limiting the scope of a security incident?