Incident Response & Threat Detection Flashcards

What is the first step in the incident response process?

Answer: Preparation

The first and foundational step in the incident response process is preparation. This involves establishing comprehensive policies, procedures, and tools, as well as training personnel, to effectively handle security incidents before they occur. Proper preparation ensures an organization is ready to detect, analyze, contain, eradicate, and recover from incidents efficiently and effectively.

Which of the following best describes threat hunting?

Answer: Manually searching for indicators of compromise.

Threat hunting is a proactive cybersecurity activity where security analysts actively and iteratively search through networks and endpoints to detect and isolate advanced threats that have evaded existing security solutions. Unlike reactive security measures that wait for alerts, threat hunting involves manually searching for indicators of compromise (IOCs) and unusual patterns to uncover hidden malicious activity.

What is the purpose of a security information and event management (SIEM) system?

Answer: Monitor and analyze security data in real time.

A Security Information and Event Management (SIEM) system centralizes and analyzes security logs and event data from various sources across an organization's IT infrastructure. Its primary purpose is to provide real-time monitoring, correlation, and alerting for security incidents. SIEM systems help organizations detect threats, manage vulnerabilities, and ensure compliance by providing a comprehensive view of their security posture.

Which term describes evidence that indicates a potential security breach?

Answer: Indicators of compromise

Indicators of Compromise (IOCs) are forensic data that indicate a high probability of a security intrusion or data breach. These can include unusual network traffic patterns, malicious file hashes, suspicious system changes, or specific IP addresses. Security professionals use IOCs to detect, investigate, and respond to cyberattacks, helping to identify compromised systems and prevent further damage.

What is the primary goal of containment during incident response?

Answer: To stop the incident from spreading.

Containment is a critical phase in incident response aimed at limiting the scope and impact of a security breach. Its primary goal is to prevent the incident from escalating, infecting more systems, or causing further damage. By isolating affected systems or networks, organizations can minimize the overall harm and prepare for eradication.

What should be done immediately after detecting a confirmed breach?

Answer: Alert the incident response team.

Upon confirming a breach, immediate action is crucial to mitigate damage and initiate a structured response. Alerting the incident response team ensures that trained professionals can quickly mobilize, assess the situation, and begin executing the predefined incident response plan. This prompt notification is essential for an effective and coordinated defense.

Why is documentation important in incident response?

Answer: To track and learn from incidents.

Documentation is vital throughout the entire incident response lifecycle. It provides a detailed record of the incident, including detection, actions taken, evidence collected, and outcomes. This comprehensive record allows organizations to analyze past incidents, identify trends, improve future response strategies, and demonstrate compliance.

Which of the following is an example of an indicator of compromise?

Answer: Unusual outbound network traffic.

An Indicator of Compromise (IOC) is forensic data that identifies potentially malicious activity on a system or network. Unusual outbound network traffic, especially to unknown destinations or in large volumes, often signals that an attacker is exfiltrating data or establishing command-and-control communications. This deviation from normal behavior is a strong sign of a potential breach.

What is the final phase in the incident response process?

Answer: Lessons learned

The "Lessons Learned" phase is the final, yet crucial, step in the incident response process. During this phase, the incident response team reviews the entire incident, evaluating what went well and what could be improved. This analysis helps refine policies, procedures, and technologies to enhance an organization's overall security posture and preparedness for future incidents.