CNDA Intrusion Detection and Incident Response 2

Question 1

During a forensic investigation, which principle ensures the integrity of digital evidence?

Accepted Answer

Chain of custody and hashing evidence with SHA-256 upon acquisition

Answer

Using the original media for all analysis

Answer

Storing evidence on a shared network drive

Answer

Deleting unnecessary files before imaging

Question 2

What is 'lateral movement' in the context of a network intrusion?

Accepted Answer

An attacker traversing from the initial foothold to other systems within the network

Answer

Moving files between servers

Answer

Changing user permissions horizontally

Answer

Routing traffic through multiple firewalls

Question 3

Which tool is used by a CNDA to capture and analyze live network traffic during an incident?

Accepted Answer

Wireshark or tcpdump

Answer

Nessus

Answer

Metasploit

Answer

Nmap

Question 4

What does 'mean time to detect' (MTTD) measure in a security operations context?

Accepted Answer

The average time between an attacker gaining access and the defender detecting the intrusion

Answer

Time to patch a vulnerability after discovery

Answer

Time to restore systems after an incident

Answer

Time to respond to a detected alert

Question 5

During eradication after a malware incident, which step is CRITICAL before returning systems to production?

Accepted Answer

Verifying that all attacker-created artifacts, backdoors, and persistence mechanisms have been removed

Answer

Notifying all users of the incident

Answer

Updating the asset inventory

Answer

Filing an insurance claim

Question 6

What is the primary goal of the 'lessons learned' phase in NIST's incident response process?

Accepted Answer

To document findings and improve defenses, processes, and detection capabilities for future incidents

Answer

To assign blame for the incident

Answer

To complete regulatory reporting

Answer

To calculate the financial cost of the breach