CND Incident Response & Disaster Recovery 2

Question 1

During the containment phase of incident response, which strategy isolates an infected host while preserving forensic evidence?

Accepted Answer

Network segmentation using VLAN or firewall ACL changes

Answer

Network segmentation via VLANs or ACLs isolates the compromised host from the rest of the network while keeping it powered on to preserve volatile memory evidence.

Question 2

What does the term 'RTO' represent in disaster recovery planning?

Accepted Answer

Recovery Time Objective — the maximum tolerable downtime after a disaster

Answer

RTO (Recovery Time Objective) defines the maximum acceptable length of time that a system can be offline after a disaster before business impact becomes unacceptable.

Question 3

Which artifact should an incident responder collect FIRST from a live Windows system before pulling the power?

Accepted Answer

Contents of RAM (memory dump)

Answer

RAM holds volatile data including running processes, network connections, and encryption keys that are permanently lost when power is removed, so it must be captured first.

Question 4

An organization's DR plan calls for a 'warm site.' Which statement best describes a warm site?

Accepted Answer

A facility with hardware and connectivity pre-installed but requiring data restoration before use

Answer

A warm site has pre-installed hardware and network connectivity but requires restoring recent backups before it becomes fully operational, balancing cost and recovery speed.

Question 5

Which incident response phase involves removing malware, closing vulnerabilities, and restoring affected systems to normal operation?

Accepted Answer

Eradication

Answer

Eradication is the phase where root causes are eliminated — malware removed, patches applied, and compromised credentials reset — before systems are returned to production.

(CND) Certified Network Defender Practice Test

(CND) Certified Network Defender Practice Test

CND Incident Response & Disaster Recovery 2