Continuous Monitoring & Incident Response Flashcards

Which artifact should be preserved FIRST when performing forensic analysis after a container compromise?

Answer: Running container memory snapshot and filesystem

A running container's volatile memory and ephemeral filesystem hold live attack evidence that is permanently lost once the container is stopped.

What is the role of threat intelligence feeds in continuous monitoring?

Answer: Enriching alerts with known attacker TTPs and IOCs to prioritize response

Threat intelligence feeds supply indicators of compromise (IOCs) and tactics that help analysts decide which alerts represent real, active threats.

A DevSecOps team receives an alert that a build server is communicating with a known command-and-control IP. Which incident response phase does the initial triage belong to?

Answer: Identification

Triage determines whether an alert represents a real incident, which is the identification phase of the NIST incident response lifecycle.

Which practice reduces alert fatigue in a security operations center monitoring a DevSecOps pipeline?

Answer: Tuning alert rules using baselines and suppressing known-good patterns

Baselining normal behavior and suppressing known-good events reduces noise while preserving detection of genuine anomalies.

What does a 'golden signal' approach to monitoring measure in microservices?

Answer: Latency, traffic, errors, and saturation

Google's four golden signals—latency, traffic, errors, and saturation—provide the minimal set of metrics needed to understand service health.

During incident eradication, a team discovers a backdoor in a production Docker image. What is the correct remediation sequence?

Answer: Rebuild the image from a clean base in the pipeline, redeploy, and invalidate all compromised image tags

Backdoored images must be rebuilt from clean sources through the trusted pipeline; patching in place leaves the supply chain compromised.

Which log source is most critical for detecting privilege escalation attacks within a Kubernetes cluster?

Answer: Kubernetes API server audit logs

Kubernetes API server audit logs record every API call including RBAC-sensitive operations like binding roles or accessing secrets, making privilege escalation visible.