CCST Security Incident Handling Process 2

Question 1

What is the first step in the NIST incident response lifecycle?

Accepted Answer

Preparation

Answer

Detection and Analysis

Answer

Containment, Eradication, and Recovery

Answer

Post-Incident Activity

Question 2

What is the difference between short-term and long-term containment?

Accepted Answer

Short-term stops immediate damage; long-term implements sustainable controls during investigation

Answer

Short-term involves patching; long-term involves monitoring

Answer

Short-term notifies management; long-term notifies law enforcement

Answer

No difference; containment is single-step

Question 3

Why is maintaining chain of custody important during incident handling?

Accepted Answer

To ensure digital evidence is properly documented, preserved, and admissible in legal proceedings

Answer

To speed up response

Answer

To prevent employees from learning about the incident

Answer

To reduce cost

Question 4

What is the purpose of the eradication phase?

Accepted Answer

To completely remove the threat and its artifacts from all affected systems

Answer

To notify customers

Answer

To restore from backup

Answer

To document the incident

Question 5

What should a lessons learned meeting focus on after an incident?

Accepted Answer

Analyzing what happened, what worked, what could improve, and how to prevent recurrence

Answer

Assigning blame

Answer

Planning the annual budget

Answer

Training on basic computer skills

Question 6

What role does a SIEM play in incident detection?

Accepted Answer

It collects, correlates, and analyzes log data from multiple sources to identify potential incidents

Answer

It patches vulnerabilities automatically

Answer

It blocks all incoming traffic

Answer

It encrypts data at rest