CCD Incident Response & Handling 2

Question 1

During the containment phase of incident response, which action best limits lateral movement by an attacker who has compromised a workstation?

Accepted Answer

Isolate the host from the network while preserving it for forensics

Answer

Network isolation stops lateral movement while keeping the host intact for forensic analysis.

Question 2

Which artifact is MOST useful when reconstructing the exact sequence of attacker commands on a compromised Linux system?

Accepted Answer

Bash history file (.bash_history)

Answer

.bash_history records commands executed in the shell, making it essential for reconstructing attacker activity.

Question 3

A security analyst identifies an active intrusion at 2 AM. The IR plan requires management notification within one hour. Which step should happen FIRST?

Accepted Answer

Notify the incident response team and escalate per the IR plan

Answer

Escalation and notification must occur before remediation to ensure proper authorization and coordination.

Question 4

What does the term 'dwell time' refer to in the context of incident response?

Accepted Answer

Duration between initial compromise and detection

Answer

Dwell time measures how long an attacker remained undetected between compromise and discovery.

Question 5

Which NIST SP 800-61 phase involves analyzing the scope, impact, and root cause of a confirmed security incident?

Accepted Answer

Detection and Analysis

Answer

Detection and Analysis covers validating alerts, scoping the incident, and understanding its nature and impact.

(CCD) Certified Cyber Defender Practice Test

(CCD) Certified Cyber Defender Practice Test

CCD Incident Response & Handling 2