CND Incident Response & Disaster Recovery 3 — Questions and Answers
Question 1: What is the key difference between an 'incident' and an 'event' in the context of NIST SP 800-61?
- Events are always malicious; incidents may be benign
- An incident is an adverse event that threatens security; an event is any observable occurrence (Correct answer)
- Incidents occur only on endpoints; events occur only on networks
- Events require immediate escalation; incidents do not
Correct answer: An incident is an adverse event that threatens security; an event is any observable occurrence
NIST SP 800-61 defines an event as any observable occurrence in a system, while an incident is an event that actually or potentially jeopardizes confidentiality, integrity, or availability.
Question 2: Which backup strategy captures only the data changed since the LAST INCREMENTAL backup, resulting in the fastest backup but slowest restore?
- Full backup
- Differential backup
- Incremental backup (Correct answer)
- Mirror backup
Correct answer: Incremental backup
Incremental backups only capture changes since the previous backup (full or incremental), making them fast to create but requiring all increments to be restored sequentially, slowing recovery.
Question 3: A security analyst notices C2 beaconing traffic from an internal host every 60 seconds. In which incident response phase should the analyst formally document this as a confirmed incident?
- Preparation
- Identification (Correct answer)
- Containment
- Eradication
Correct answer: Identification
The Identification phase is where events are analyzed, correlated, and formally declared as confirmed incidents after meeting defined threshold criteria.
Question 4: Which disaster recovery metric defines the maximum age of data that an organization can afford to lose in a disruption?
- RTO (Recovery Time Objective)
- MTTR (Mean Time to Repair)
- RPO (Recovery Point Objective) (Correct answer)
- MTBF (Mean Time Between Failures)
Correct answer: RPO (Recovery Point Objective)
RPO (Recovery Point Objective) defines how much data loss is tolerable, directly determining how frequently backups must be taken.
Question 5: When performing forensic disk imaging, which tool creates a bit-for-bit copy and generates an MD5/SHA hash to verify integrity?
- Wireshark
- dd or dcfldd (Correct answer)
- Nmap
- Netstat
Correct answer: dd or dcfldd
Tools like dd and dcfldd create forensically sound bit-for-bit disk images and compute cryptographic hashes to verify that the copy is identical to the original.
Question 6: An IR team uses the term 'IoC' during an investigation. What does IoC stand for and what is its purpose?
- Index of Compromise — tracks patch levels on endpoints
- Indicator of Compromise — artifacts that signal a system has been breached (Correct answer)
- Instance of Control — defines which team member owns each task
- Integrity of Configuration — validates system baseline settings
Correct answer: Indicator of Compromise — artifacts that signal a system has been breached
Indicators of Compromise (IoCs) are forensic artifacts such as malicious IPs, file hashes, or registry keys that indicate a system has been compromised.
Question 7: In a DR test scenario, a 'tabletop exercise' is best described as:
- A full failover to the backup site with production traffic
- A discussion-based walkthrough of the DR plan without activating systems (Correct answer)
- Hardware replacement drill under time pressure
- Automated backup restoration test with verification
Correct answer: A discussion-based walkthrough of the DR plan without activating systems
A tabletop exercise is a scenario-driven discussion where team members talk through their responses to a hypothetical disaster without actually executing any technical steps.
CND Incident Response & Disaster Recovery 3
What is the key difference between an 'incident' and an 'event' in the context of NIST SP 800-61?