CND Incident Response & Disaster Recovery 2 — Questions and Answers
Question 1: During the containment phase of incident response, which strategy isolates an infected host while preserving forensic evidence?
- Immediate shutdown of the host
- Network segmentation using VLAN or firewall ACL changes (Correct answer)
- Reinstalling the operating system
- Disabling all network interfaces permanently
Correct answer: Network segmentation using VLAN or firewall ACL changes
Network segmentation via VLANs or ACLs isolates the compromised host from the rest of the network while keeping it powered on to preserve volatile memory evidence.
Question 2: What does the term 'RTO' represent in disaster recovery planning?
- Recovery Time Objective — the maximum tolerable downtime after a disaster (Correct answer)
- Recovery Transfer Operation — moving data to a backup site
- Redundant Transfer Output — secondary data path speed
- Restoration Time Offset — lag between backup creation and restoration
Correct answer: Recovery Time Objective — the maximum tolerable downtime after a disaster
RTO (Recovery Time Objective) defines the maximum acceptable length of time that a system can be offline after a disaster before business impact becomes unacceptable.
Question 3: Which artifact should an incident responder collect FIRST from a live Windows system before pulling the power?
- Event log files from disk
- Contents of RAM (memory dump) (Correct answer)
- Registry hive backups
- Prefetch files from the filesystem
Correct answer: Contents of RAM (memory dump)
RAM holds volatile data including running processes, network connections, and encryption keys that are permanently lost when power is removed, so it must be captured first.
Question 4: An organization's DR plan calls for a 'warm site.' Which statement best describes a warm site?
- A fully operational duplicate data center that can take over in minutes
- A facility with hardware and connectivity pre-installed but requiring data restoration before use (Correct answer)
- An empty building where equipment can be shipped after a disaster
- A cloud-only recovery environment with no physical infrastructure
Correct answer: A facility with hardware and connectivity pre-installed but requiring data restoration before use
A warm site has pre-installed hardware and network connectivity but requires restoring recent backups before it becomes fully operational, balancing cost and recovery speed.
Question 5: Which incident response phase involves removing malware, closing vulnerabilities, and restoring affected systems to normal operation?
- Identification
- Eradication (Correct answer)
- Lessons Learned
- Detection
Correct answer: Eradication
Eradication is the phase where root causes are eliminated — malware removed, patches applied, and compromised credentials reset — before systems are returned to production.
Question 6: A chain of custody document in incident response is primarily used to:
- Record which analysts were on call during the incident
- Track evidence handling to ensure its integrity and admissibility in legal proceedings (Correct answer)
- Log system performance metrics during recovery
- Document software licenses used during the investigation
Correct answer: Track evidence handling to ensure its integrity and admissibility in legal proceedings
Chain of custody records every person who handled evidence, when, and why, ensuring that evidence integrity can be proven in court or disciplinary proceedings.
Question 7: During post-incident analysis, what is the PRIMARY purpose of a 'lessons learned' meeting?
- To assign blame to the team members who made errors
- To identify process gaps and improve defenses before the next incident (Correct answer)
- To calculate the total financial loss from the incident
- To notify regulators about the breach details
Correct answer: To identify process gaps and improve defenses before the next incident
Lessons learned meetings focus on improving processes, tools, and training so that the organization responds more effectively to future incidents.
CND Incident Response & Disaster Recovery 2
During the containment phase of incident response, which strategy isolates an infected host while preserving forensic evidence?