CAP Incident Response & Recovery 2

Question 1

Which NIST SP 800-61 phase involves preserving evidence and limiting the scope of a security incident?

Accepted Answer

Containment, Eradication, and Recovery

Answer

The Containment, Eradication, and Recovery phase focuses on stopping the spread of an incident and preserving evidence while restoring systems.

Question 2

During incident response, what is the primary purpose of a chain of custody document?

Accepted Answer

To ensure evidence integrity and admissibility

Answer

Chain of custody documents track who handled evidence and when, ensuring its integrity and legal admissibility.

Question 3

A security analyst notices anomalous outbound traffic to an unknown IP address. According to NIST SP 800-61, this falls into which incident category?

Accepted Answer

Malicious Code

Answer

Anomalous outbound traffic to unknown IPs is typically indicative of malicious code (e.g., malware beaconing to a C2 server).

Question 4

In the context of FedRAMP incident reporting, what is the required timeframe for reporting a major incident to US-CERT?

Accepted Answer

Within 1 hour

Answer

FedRAMP requires cloud service providers to report major security incidents to US-CERT within one hour of discovery.

Question 5

What is the key difference between a security 'event' and a security 'incident' under NIST SP 800-61?

Accepted Answer

An incident adversely affects information or systems, while an event is any observable occurrence

Answer

An event is any observable occurrence in a system, while an incident is an event that actually or potentially jeopardizes confidentiality, integrity, or availability.

(CAP) Certified Authorization Professional Practice Test

(CAP) Certified Authorization Professional Practice Test

CAP Incident Response & Recovery 2