CCST Security Incident Handling Process 2

Question 1

What is the first step in the NIST incident response lifecycle?

Accepted Answer

Preparation

Answer

Preparation involves establishing the CSIRT, creating policies, deploying tools, and conducting training.

Question 2

What is the difference between short-term and long-term containment?

Accepted Answer

Short-term stops immediate damage; long-term implements sustainable controls during investigation

Answer

Short-term: rapid actions to stop spread. Long-term: sustainable controls allowing continued operations during investigation.

Question 3

Why is maintaining chain of custody important during incident handling?

Accepted Answer

To ensure digital evidence is properly documented, preserved, and admissible in legal proceedings

Answer

Chain of custody documents every handler of evidence, ensuring integrity and court admissibility.

Question 4

What is the purpose of the eradication phase?

Accepted Answer

To completely remove the threat and its artifacts from all affected systems

Answer

Eradication removes all malware, backdoors, and unauthorized changes, and patches exploited vulnerabilities.

Question 5

What should a lessons learned meeting focus on after an incident?

Accepted Answer

Analyzing what happened, what worked, what could improve, and how to prevent recurrence

Answer

Post-incident review evaluates response effectiveness and produces actionable improvements.

(CCST) Cisco Certified Support Technician Practice Test