Incident Response & Threat Detection Flashcards

During a containment phase, a responder isolates an infected host by removing it from the network. What is the PRIMARY risk of this action?

Answer: Destroying volatile memory evidence before capture

Network isolation can disrupt live memory, which holds ephemeral artifacts like running processes, open connections, and encryption keys crucial to the investigation.

A SIEM alert fires on repeated failed logins followed immediately by a successful login from a foreign IP. Which MITRE ATT&CK tactic does this pattern most directly map to?

Answer: Credential Access via Brute Force

Repeated failed logins succeeded by a success from an unusual IP is the classic signature of brute-force credential access (T1110).

Which log source is MOST valuable for reconstructing the exact sequence of commands an attacker ran on a compromised Linux host?

Answer: Auditd with execve syscall rules

Auditd configured to capture execve syscalls records every command execution at the kernel level and cannot be trivially cleared by the user like bash_history.

An analyst receives a threat intelligence feed indicating a new C2 domain. What is the FASTEST defensive action that blocks communication without requiring endpoint changes?

Answer: Add the domain to DNS RPZ (Response Policy Zone) sinkhole

A DNS RPZ sinkhole immediately intercepts and redirects DNS queries for the malicious domain across the entire network without touching individual endpoints.

After eradication of malware, what is the CRITICAL step before returning a system to production?

Answer: Restoring from a known-good backup or rebuilding the system

Malware can leave persistent backdoors invisible to scanners; restoring from a pre-incident clean backup or rebuilding ensures a trustworthy baseline.

A threat hunter notices PowerShell launching from within Microsoft Word. Which detection technique most directly identifies this parent-child process anomaly?

Answer: Process lineage / parent-child process analysis

Parent-child process analysis examines the spawning relationship between processes, making it ideal for catching living-off-the-land techniques like Office → PowerShell.

During lessons-learned, the team identifies that dwell time was 47 days. Which control failure MOST likely contributed to the extended dwell time?

Answer: Insufficient SIEM alerting and threat hunting cadence

Long dwell time indicates that detection mechanisms—SIEM tuning, alert triage, and proactive threat hunting—were insufficient to surface attacker activity sooner.