CNDA Intrusion Detection and Incident Response 2 — Questions and Answers
Question 1: During a forensic investigation, which principle ensures the integrity of digital evidence?
- Using the original media for all analysis
- Chain of custody and hashing evidence with SHA-256 upon acquisition (Correct answer)
- Storing evidence on a shared network drive
- Deleting unnecessary files before imaging
Correct answer: Chain of custody and hashing evidence with SHA-256 upon acquisition
Chain of custody documents who handled evidence and when, while cryptographic hashes verify the evidence has not been altered.
Question 2: What is 'lateral movement' in the context of a network intrusion?
- Moving files between servers
- An attacker traversing from the initial foothold to other systems within the network (Correct answer)
- Changing user permissions horizontally
- Routing traffic through multiple firewalls
Correct answer: An attacker traversing from the initial foothold to other systems within the network
Lateral movement describes techniques attackers use to progressively access additional systems after gaining initial access, often using stolen credentials.
Question 3: Which tool is used by a CNDA to capture and analyze live network traffic during an incident?
- Nessus
- Wireshark or tcpdump (Correct answer)
- Metasploit
- Nmap
Correct answer: Wireshark or tcpdump
Wireshark and tcpdump capture raw network packets, allowing analysts to reconstruct sessions and identify malicious traffic patterns.
Question 4: What does 'mean time to detect' (MTTD) measure in a security operations context?
- Time to patch a vulnerability after discovery
- The average time between an attacker gaining access and the defender detecting the intrusion (Correct answer)
- Time to restore systems after an incident
- Time to respond to a detected alert
Correct answer: The average time between an attacker gaining access and the defender detecting the intrusion
MTTD measures detection latency — a lower MTTD means attackers spend less time undetected and can cause less damage.
Question 5: During eradication after a malware incident, which step is CRITICAL before returning systems to production?
- Notifying all users of the incident
- Verifying that all attacker-created artifacts, backdoors, and persistence mechanisms have been removed (Correct answer)
- Updating the asset inventory
- Filing an insurance claim
Correct answer: Verifying that all attacker-created artifacts, backdoors, and persistence mechanisms have been removed
Thorough eradication must confirm all backdoors, scheduled tasks, registry modifications, and malware components are removed before recovery.
Question 6: What is the primary goal of the 'lessons learned' phase in NIST's incident response process?
- To assign blame for the incident
- To document findings and improve defenses, processes, and detection capabilities for future incidents (Correct answer)
- To complete regulatory reporting
- To calculate the financial cost of the breach
Correct answer: To document findings and improve defenses, processes, and detection capabilities for future incidents
Lessons learned turns incident data into actionable improvements, updating playbooks, controls, and detection logic to prevent recurrence.
CNDA Intrusion Detection and Incident Response 2
During a forensic investigation, which principle ensures the integrity of digital evidence?