Continuous Monitoring & Incident Response Flashcards

A CI/CD pipeline secret is leaked in a public GitHub repository. According to incident response best practices, what is the immediate first action?

Answer: Revoke and rotate the exposed secret immediately

Once a secret is public it must be treated as compromised and rotated immediately since git history is cached and mirrored within seconds.

What is the primary benefit of integrating Security Orchestration, Automation and Response (SOAR) with a SIEM in DevSecOps?

Answer: Automating repetitive response actions to reduce MTTR for common incident types

SOAR automates high-volume, well-defined response playbooks so analysts focus on complex cases, reducing Mean Time to Respond.

Which anomaly detection technique is best suited for detecting insider threats in a DevSecOps environment?

Answer: User and Entity Behavior Analytics (UEBA)

UEBA establishes behavioral baselines per user and detects deviations like unusual data access or off-hours activity that signatures cannot catch.

What does the NIST SP 800-137 framework define as continuous monitoring?

Answer: Ongoing awareness of information security, vulnerabilities, and threats to support risk management decisions

NIST SP 800-137 defines continuous monitoring as maintaining ongoing situational awareness to support timely risk management decisions across the information security program.

A security team is designing incident response for a serverless application. Which challenge is unique to this architecture?

Answer: Ephemeral execution environments that disappear before forensics can be performed

Serverless functions execute and terminate in milliseconds, leaving no persistent runtime environment to inspect after an incident.

Which metric measures how long an attacker remains in an environment before detection, directly reflecting monitoring program gaps?

Answer: Dwell time (Mean Time to Detect)

Dwell time—the attacker's undetected presence duration—is the direct measure of how large the monitoring blind spots are.

During post-incident review, a team discovers that alerts were generated but not acted upon for 72 hours. Which process improvement addresses this gap?

Answer: Implement alert triage SLAs with escalation procedures and on-call rotations

Alert SLAs with defined escalation paths ensure that critical alerts receive a human response within a required timeframe.