Incident Response & Disaster Recovery Flashcards

During the containment phase of incident response, which strategy isolates an infected host while preserving forensic evidence?

Answer: Network segmentation using VLAN or firewall ACL changes

Network segmentation via VLANs or ACLs isolates the compromised host from the rest of the network while keeping it powered on to preserve volatile memory evidence.

What does the term 'RTO' represent in disaster recovery planning?

Answer: Recovery Time Objective — the maximum tolerable downtime after a disaster

RTO (Recovery Time Objective) defines the maximum acceptable length of time that a system can be offline after a disaster before business impact becomes unacceptable.

Which artifact should an incident responder collect FIRST from a live Windows system before pulling the power?

Answer: Contents of RAM (memory dump)

RAM holds volatile data including running processes, network connections, and encryption keys that are permanently lost when power is removed, so it must be captured first.

An organization's DR plan calls for a 'warm site.' Which statement best describes a warm site?

Answer: A facility with hardware and connectivity pre-installed but requiring data restoration before use

A warm site has pre-installed hardware and network connectivity but requires restoring recent backups before it becomes fully operational, balancing cost and recovery speed.

Which incident response phase involves removing malware, closing vulnerabilities, and restoring affected systems to normal operation?

Answer: Eradication

Eradication is the phase where root causes are eliminated — malware removed, patches applied, and compromised credentials reset — before systems are returned to production.

A chain of custody document in incident response is primarily used to:

Answer: Track evidence handling to ensure its integrity and admissibility in legal proceedings

Chain of custody records every person who handled evidence, when, and why, ensuring that evidence integrity can be proven in court or disciplinary proceedings.

During post-incident analysis, what is the PRIMARY purpose of a 'lessons learned' meeting?

Answer: To identify process gaps and improve defenses before the next incident

Lessons learned meetings focus on improving processes, tools, and training so that the organization responds more effectively to future incidents.

What is the key difference between an 'incident' and an 'event' in the context of NIST SP 800-61?

Answer: An incident is an adverse event that threatens security; an event is any observable occurrence

NIST SP 800-61 defines an event as any observable occurrence in a system, while an incident is an event that actually or potentially jeopardizes confidentiality, integrity, or availability.

Which backup strategy captures only the data changed since the LAST INCREMENTAL backup, resulting in the fastest backup but slowest restore?

Answer: Incremental backup

Incremental backups only capture changes since the previous backup (full or incremental), making them fast to create but requiring all increments to be restored sequentially, slowing recovery.

A security analyst notices C2 beaconing traffic from an internal host every 60 seconds. In which incident response phase should the analyst formally document this as a confirmed incident?

Answer: Identification

The Identification phase is where events are analyzed, correlated, and formally declared as confirmed incidents after meeting defined threshold criteria.

Which disaster recovery metric defines the maximum age of data that an organization can afford to lose in a disruption?

Answer: RPO (Recovery Point Objective)

RPO (Recovery Point Objective) defines how much data loss is tolerable, directly determining how frequently backups must be taken.

When performing forensic disk imaging, which tool creates a bit-for-bit copy and generates an MD5/SHA hash to verify integrity?

Answer: dd or dcfldd

Tools like dd and dcfldd create forensically sound bit-for-bit disk images and compute cryptographic hashes to verify that the copy is identical to the original.

An IR team uses the term 'IoC' during an investigation. What does IoC stand for and what is its purpose?

Answer: Indicator of Compromise — artifacts that signal a system has been breached

Indicators of Compromise (IoCs) are forensic artifacts such as malicious IPs, file hashes, or registry keys that indicate a system has been compromised.

In a DR test scenario, a 'tabletop exercise' is best described as:

Answer: A discussion-based walkthrough of the DR plan without activating systems

A tabletop exercise is a scenario-driven discussion where team members talk through their responses to a hypothetical disaster without actually executing any technical steps.

Which type of malware analysis runs a suspicious file in an isolated environment to observe its behavior without risking production systems?

Answer: Dynamic analysis (sandboxing)

Dynamic analysis executes malware in a controlled sandbox environment to observe real-time behaviors such as file creation, registry changes, and network connections.

A company's BCP states that critical payroll processing must continue even if the primary data center is destroyed. Which strategy BEST meets this requirement?

Answer: Hot site with real-time data replication

A hot site with real-time replication ensures zero data loss and near-instant failover, making it the only option that can sustain critical operations immediately after a site-level disaster.

Which evidence collection principle states that the most volatile data must be collected before less volatile data?

Answer: Order of Volatility

The Order of Volatility (RFC 3227) dictates collecting data from most volatile (RAM, CPU registers) to least volatile (optical media, paper) to prevent loss of perishable evidence.

During incident response, when should an organization notify law enforcement?

Answer: When the incident involves criminal activity, significant financial loss, or national security implications

Law enforcement notification is appropriate when incidents involve criminal activity (e.g., ransomware, financial fraud), critical infrastructure, or meet reporting thresholds under applicable laws.

What is the primary function of a Security Information and Event Management (SIEM) system in incident response?

Answer: Aggregating and correlating log data from multiple sources to detect incidents

A SIEM collects, normalizes, and correlates log and event data from across the environment to detect suspicious patterns and generate alerts for incident responders.

A ransomware attack has encrypted files on 200 workstations. According to IR best practices, what should the team do IMMEDIATELY after detection?

Answer: Disconnect affected systems from the network to prevent further spread

Immediate network isolation stops ransomware from spreading laterally to additional systems, limiting the blast radius before eradication and recovery begin.