CCST Security Incident Handling Process 3

Question 1

What is an Indicator of Compromise (IOC)?

Accepted Answer

Observable evidence that a system may have been breached, such as unusual traffic or known malicious IPs

Answer

IOCs are artifacts like malicious IPs, file hashes, and suspicious patterns that help identify breaches.

Question 2

When should law enforcement be notified during a security incident?

Accepted Answer

When criminal activity is involved, regulations require it, or law enforcement assistance is needed

Answer

Notify when criminal activity occurs, regulations mandate it, or law enforcement capabilities are needed.

Question 3

What is the purpose of creating a forensic image?

Accepted Answer

To create an exact bit-for-bit copy for analysis without modifying original evidence

Answer

A forensic image preserves all data including deleted files and slack space, keeping the original untouched.

Question 4

What is the difference between an incident and an event?

Accepted Answer

An event is any observable occurrence; an incident is an event that violates security policy or poses a threat

Answer

Events are routine occurrences; incidents are events that indicate security violations or threats.

Question 5

What is a tabletop exercise and why is it valuable?

Accepted Answer

A discussion-based exercise where team members walk through a hypothetical incident to test plans and identify gaps

Answer

Tabletop exercises are low-cost simulations that test decision-making and identify weaknesses in the IR plan.

(CCST) Cisco Certified Support Technician Practice Test