CND Incident Response & Disaster Recovery 3

Question 1

What is the key difference between an 'incident' and an 'event' in the context of NIST SP 800-61?

Accepted Answer

An incident is an adverse event that threatens security; an event is any observable occurrence

Answer

NIST SP 800-61 defines an event as any observable occurrence in a system, while an incident is an event that actually or potentially jeopardizes confidentiality, integrity, or availability.

Question 2

Which backup strategy captures only the data changed since the LAST INCREMENTAL backup, resulting in the fastest backup but slowest restore?

Accepted Answer

Incremental backup

Answer

Incremental backups only capture changes since the previous backup (full or incremental), making them fast to create but requiring all increments to be restored sequentially, slowing recovery.

Question 3

A security analyst notices C2 beaconing traffic from an internal host every 60 seconds. In which incident response phase should the analyst formally document this as a confirmed incident?

Accepted Answer

Identification

Answer

The Identification phase is where events are analyzed, correlated, and formally declared as confirmed incidents after meeting defined threshold criteria.

Question 4

Which disaster recovery metric defines the maximum age of data that an organization can afford to lose in a disruption?

Accepted Answer

RPO (Recovery Point Objective)

Answer

RPO (Recovery Point Objective) defines how much data loss is tolerable, directly determining how frequently backups must be taken.

Question 5

When performing forensic disk imaging, which tool creates a bit-for-bit copy and generates an MD5/SHA hash to verify integrity?

Accepted Answer

dd or dcfldd

Answer

Tools like dd and dcfldd create forensically sound bit-for-bit disk images and compute cryptographic hashes to verify that the copy is identical to the original.

(CND) Certified Network Defender Practice Test

(CND) Certified Network Defender Practice Test

CND Incident Response & Disaster Recovery 3