CISSP Incident Response and Forensics 3

Question 1

A post-incident review is conducted after every major security incident. What is the primary goal of this activity?

Accepted Answer

To identify lessons learned and improve future response capabilities

Answer

To assign blame to responsible personnel

Answer

To satisfy regulatory reporting requirements

Answer

To determine the financial loss from the incident

Question 2

Which type of evidence is derived from a primary source and may be used to support other evidence in a forensic investigation?

Accepted Answer

Corroborative evidence

Answer

Direct evidence

Answer

Best evidence

Answer

Hearsay evidence

Question 3

During eradication of an incident, a responder removes malware from all affected systems. What should immediately follow eradication before returning systems to production?

Accepted Answer

Performing recovery and verification

Answer

Notifying the public

Answer

Closing the incident ticket

Answer

Assigning a root cause

Question 4

What is the role of an incident response retainer agreement with a third-party IR firm?

Accepted Answer

It ensures access to specialized IR expertise on short notice when needed

Answer

It permanently outsources all security operations

Answer

It provides automated malware removal services

Answer

It replaces the need for an internal CSIRT

Question 5

Which memory forensics artifact can reveal currently running processes, open network connections, and loaded drivers that may not appear in on-disk analysis?

Accepted Answer

RAM (volatile memory) dump

Answer

Windows Registry hive

Answer

System log files

Answer

File allocation table

Question 6

Which term describes an attack technique where an adversary uses legitimate administrative tools (e.g., PowerShell, WMI) to conduct malicious activity, making detection harder?

Accepted Answer

Living off the land (LotL)

Answer

Zero-day exploit

Answer

Watering hole attack

Answer

SQL injection

Question 7

Under the NIST incident response lifecycle, which phase directly follows containment, eradication, and recovery?

Accepted Answer

Post-Incident Activity

Answer

Preparation

Answer

Detection and Analysis

Answer

Identification