Intrusion Detection and Incident Response Flashcards

Which concept describes a threat actor maintaining persistent, undetected access to a network over an extended period?

Answer: Advanced Persistent Threat (APT)

APTs are sophisticated, long-term attacks often attributed to nation-state actors who maintain stealthy access to exfiltrate data over months or years.

A SOC analyst receives an alert about an impossible travel event — a user logged in from New York and Tokyo within 30 minutes. What should be the FIRST response step?

Answer: Disable the account temporarily and contact the user to verify legitimacy

The first step is to disable access to prevent potential ongoing compromise while verifying whether the activity was legitimate, such as VPN use.

What is a 'threat hunting' program in the context of network defense?

Answer: Proactively searching for indicators of compromise or attacker activity not yet flagged by automated systems

Threat hunting is a proactive, analyst-led process of searching for hidden threats that have evaded automated detection tools.

Which log source is MOST valuable for detecting privilege escalation on a Windows system?

Answer: Windows Security Event Log (Event ID 4672 - Special Privileges Assigned)

Windows Security Event ID 4672 is generated whenever special privileges are assigned to a new logon, indicating potential privilege escalation.

What is the MITRE ATT&CK framework used for in incident response?

Answer: Mapping observed attacker behaviors to a taxonomy of known tactics, techniques, and procedures (TTPs)

MITRE ATT&CK provides a structured knowledge base of adversary TTPs that analysts use to understand, detect, and attribute attacks.

Which IR containment strategy involves blocking a malicious domain at the DNS level to prevent malware from communicating with C2?

Answer: DNS sinkholing

DNS sinkholing redirects queries for malicious domains to a controlled server, severing C2 communication while identifying infected hosts.