CCST - Cisco Certified Support Technician Security Incident Handling Process Questions and Answers

Question 1

Which of the following activities is a critical component of the 'Preparation' phase of the security incident handling process, according to the NIST framework?

Accepted Answer

Establishing and training a Computer Security Incident Response Team (CSIRT).

Answer

Analyzing system logs to determine the scope of a breach.

Answer

Restoring data from backups after a ransomware attack.

Answer

Disconnecting an infected machine from the network.

Question 2

A support technician observes alerts from a SIEM tool indicating multiple failed login attempts on a critical server, followed by a successful login from an unrecognized IP address. Which phase of the incident handling process has just begun?

Accepted Answer

Detection and Analysis

Answer

Containment

Answer

Recovery

Answer

Preparation

Question 3

During a malware outbreak, a security analyst instructs a technician to immediately disconnect the infected computers from the corporate network. This action is a primary example of which incident response phase?

Accepted Answer

Containment

Answer

Eradication

Answer

Recovery

Answer

Lessons Learned

Question 4

After a security incident has been contained and the immediate threat is neutralized, a technician is tasked with re-imaging an affected workstation from a known good gold image and ensuring all security patches are applied. This activity belongs to which two connected phases of the incident response lifecycle?

Accepted Answer

Eradication and Recovery

Answer

Preparation and Identification

Answer

Detection and Analysis

Answer

Containment and Lessons Learned

Question 5

A company has just recovered from a major data breach. The management team holds a meeting with the IT and security staff to review the incident timeline, discuss what went well, identify weaknesses in the response, and update the incident response plan. In which phase of the incident handling process does this activity occur?

Accepted Answer

Post-Incident Activity (Lessons Learned)

Answer

Recovery

Answer

Preparation

Answer

Containment

Question 6

According to the NIST SP 800-61 incident response lifecycle, what is the correct sequence of the major phases?

Accepted Answer

Preparation, Detection and Analysis, Containment/Eradication/Recovery, Post-Incident Activity

Answer

Detection, Containment, Preparation, Recovery

Answer

Identification, Eradication, Recovery, Preparation

Answer

Containment, Preparation, Detection, Post-Incident Activity