CCD Incident Response & Handling 2 — Questions and Answers
Question 1: During the containment phase of incident response, which action best limits lateral movement by an attacker who has compromised a workstation?
- Reimage the compromised host immediately
- Isolate the host from the network while preserving it for forensics (Correct answer)
- Disable all user accounts enterprise-wide
- Shut down the entire network segment
Correct answer: Isolate the host from the network while preserving it for forensics
Network isolation stops lateral movement while keeping the host intact for forensic analysis.
Question 2: Which artifact is MOST useful when reconstructing the exact sequence of attacker commands on a compromised Linux system?
- Firewall logs
- Bash history file (.bash_history) (Correct answer)
- DNS resolver cache
- CPU utilization metrics
Correct answer: Bash history file (.bash_history)
.bash_history records commands executed in the shell, making it essential for reconstructing attacker activity.
Question 3: A security analyst identifies an active intrusion at 2 AM. The IR plan requires management notification within one hour. Which step should happen FIRST?
- Begin eradication of the malware
- Notify the incident response team and escalate per the IR plan (Correct answer)
- Restore systems from backup
- Conduct a post-incident review
Correct answer: Notify the incident response team and escalate per the IR plan
Escalation and notification must occur before remediation to ensure proper authorization and coordination.
Question 4: What does the term 'dwell time' refer to in the context of incident response?
- Time taken to restore services after an incident
- Duration between initial compromise and detection (Correct answer)
- Time an analyst spends investigating an alert
- How long a threat actor maintains access after detection
Correct answer: Duration between initial compromise and detection
Dwell time measures how long an attacker remained undetected between compromise and discovery.
Question 5: Which NIST SP 800-61 phase involves analyzing the scope, impact, and root cause of a confirmed security incident?
- Preparation
- Detection and Analysis (Correct answer)
- Post-Incident Activity
- Eradication and Recovery
Correct answer: Detection and Analysis
Detection and Analysis covers validating alerts, scoping the incident, and understanding its nature and impact.
Question 6: An IR team discovers ransomware on a file server. Which containment strategy is MOST appropriate to prevent further encryption?
- Wipe the server and restore from backup immediately
- Disconnect the server from the network and disable associated service accounts (Correct answer)
- Deploy an IDS on the affected subnet
- Apply the latest OS patches to the affected server
Correct answer: Disconnect the server from the network and disable associated service accounts
Disconnecting the network link and disabling accounts stops active encryption spread while preserving evidence.
Question 7: Which type of evidence has the SHORTEST retention window due to volatility and must be collected first on a live system?
- Hard disk image
- Email server logs
- RAM contents and running processes (Correct answer)
- Backup tapes
Correct answer: RAM contents and running processes
RAM is volatile and lost on reboot, making it the highest priority for collection on a live system.
CCD Incident Response & Handling 2
During the containment phase of incident response, which action best limits lateral movement by an attacker who has compromised a workstation?