Incident Response & Threat Detection Flashcards

An IDS generates 5,000 alerts per day but analysts confirm only 12 true positives per week. What does this scenario BEST illustrate?

Answer: Alert fatigue caused by high false positive rate

When the vast majority of alerts are false positives, analysts become desensitized—this is the classic definition of alert fatigue.

Which forensic artifact on a Windows system BEST reveals recently accessed files even if the files themselves have been deleted?

Answer: Prefetch files and LNK (shell link) files

Prefetch files record program execution metadata, and LNK files track recently opened documents, both persisting after the original files are deleted.

A defender uses YARA rules to scan memory dumps. What is a YARA rule primarily designed to detect?

Answer: Malware patterns via string and byte sequence matching

YARA rules define patterns—strings, byte sequences, and logical conditions—that match malware families or suspicious code in files and memory.

During triage, an analyst finds a scheduled task that runs a Base64-encoded PowerShell command. What evasion technique does this represent?

Answer: Obfuscation via encoding

Base64 encoding the command payload is a common obfuscation technique to evade signature-based detection that looks for plaintext malicious strings.

Which NIST SP 800-61 incident response phase focuses specifically on stopping the spread of an incident to additional systems?

Answer: Containment, Eradication, and Recovery

The Containment, Eradication, and Recovery phase includes steps to isolate affected systems and prevent further spread of the incident.

A ransomware incident has encrypted files on a file server. The FIRST priority after confirming the incident should be:

Answer: Preserving forensic evidence and isolating affected systems

Evidence preservation and containment must come first to prevent further encryption, protect forensic artifacts, and understand the full scope before remediation.

A threat model rates a risk as HIGH likelihood but LOW impact. How should this influence prioritization in an IR runbook?

Answer: Automate detection and response but assign lower analyst priority than high-impact events

High-likelihood/low-impact events are candidates for automated playbooks that handle them efficiently without consuming analyst bandwidth reserved for high-impact incidents.