Intrusion Detection and Incident Response Flashcards

According to NIST SP 800-61, what are the four phases of the incident response lifecycle?

Answer: Preparation, Detection and Analysis, Containment/Eradication/Recovery, Post-Incident Activity

NIST SP 800-61 defines the IR lifecycle as Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity.

During containment of a network intrusion, which action BEST preserves evidence while limiting damage?

Answer: Isolate the system on a quarantine network while capturing memory and disk images

Isolating to a quarantine network stops lateral spread while preserving volatile evidence (memory, active connections) for forensic analysis.

What is the primary purpose of a SIEM (Security Information and Event Management) system?

Answer: To aggregate, correlate, and analyze security logs from multiple sources for threat detection

SIEM centralizes log collection and uses correlation rules to identify patterns across disparate sources that may indicate a security incident.

An analyst observes beaconing behavior from an internal host — regular outbound connections to an external IP at fixed intervals. What does this most likely indicate?

Answer: A command-and-control (C2) connection from malware

Regular, periodic outbound connections at fixed intervals are a hallmark of malware beaconing to a C2 server for instructions.

Which type of threat intelligence indicator would a CNDA use to identify malicious activity by matching network traffic?

Answer: Indicator of Compromise (IoC) such as a malicious IP or domain

IoCs such as malicious IPs, domains, hashes, and URL patterns can be fed into firewalls, IDS, and SIEM to detect known threats.

What is a 'playbook' in the context of incident response?

Answer: A documented, step-by-step procedure for responding to a specific type of incident

A playbook provides predefined, repeatable procedures so responders take consistent, effective action when a specific incident type occurs.