Intrusion Detection and Incident Response Flashcards

During a forensic investigation, which principle ensures the integrity of digital evidence?

Answer: Chain of custody and hashing evidence with SHA-256 upon acquisition

Chain of custody documents who handled evidence and when, while cryptographic hashes verify the evidence has not been altered.

What is 'lateral movement' in the context of a network intrusion?

Answer: An attacker traversing from the initial foothold to other systems within the network

Lateral movement describes techniques attackers use to progressively access additional systems after gaining initial access, often using stolen credentials.

Which tool is used by a CNDA to capture and analyze live network traffic during an incident?

Answer: Wireshark or tcpdump

Wireshark and tcpdump capture raw network packets, allowing analysts to reconstruct sessions and identify malicious traffic patterns.

What does 'mean time to detect' (MTTD) measure in a security operations context?

Answer: The average time between an attacker gaining access and the defender detecting the intrusion

MTTD measures detection latency — a lower MTTD means attackers spend less time undetected and can cause less damage.

During eradication after a malware incident, which step is CRITICAL before returning systems to production?

Answer: Verifying that all attacker-created artifacts, backdoors, and persistence mechanisms have been removed

Thorough eradication must confirm all backdoors, scheduled tasks, registry modifications, and malware components are removed before recovery.

What is the primary goal of the 'lessons learned' phase in NIST's incident response process?

Answer: To document findings and improve defenses, processes, and detection capabilities for future incidents

Lessons learned turns incident data into actionable improvements, updating playbooks, controls, and detection logic to prevent recurrence.