CNDA Intrusion Detection and Incident Response 1 — Questions and Answers
Question 1: According to NIST SP 800-61, what are the four phases of the incident response lifecycle?
- Identify, Protect, Detect, Respond
- Preparation, Detection and Analysis, Containment/Eradication/Recovery, Post-Incident Activity (Correct answer)
- Triage, Escalation, Resolution, Review
- Alert, Investigate, Patch, Close
Correct answer: Preparation, Detection and Analysis, Containment/Eradication/Recovery, Post-Incident Activity
NIST SP 800-61 defines the IR lifecycle as Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity.
Question 2: During containment of a network intrusion, which action BEST preserves evidence while limiting damage?
- Immediately power off the affected system
- Isolate the system on a quarantine network while capturing memory and disk images (Correct answer)
- Delete all logs to prevent attacker access
- Reinstall the OS immediately
Correct answer: Isolate the system on a quarantine network while capturing memory and disk images
Isolating to a quarantine network stops lateral spread while preserving volatile evidence (memory, active connections) for forensic analysis.
Question 3: What is the primary purpose of a SIEM (Security Information and Event Management) system?
- To replace firewalls and IDS
- To aggregate, correlate, and analyze security logs from multiple sources for threat detection (Correct answer)
- To automatically patch vulnerabilities
- To manage user accounts and passwords
Correct answer: To aggregate, correlate, and analyze security logs from multiple sources for threat detection
SIEM centralizes log collection and uses correlation rules to identify patterns across disparate sources that may indicate a security incident.
Question 4: An analyst observes beaconing behavior from an internal host — regular outbound connections to an external IP at fixed intervals. What does this most likely indicate?
- Normal NTP synchronization
- A command-and-control (C2) connection from malware (Correct answer)
- A misconfigured DHCP client
- DNS resolution activity
Correct answer: A command-and-control (C2) connection from malware
Regular, periodic outbound connections at fixed intervals are a hallmark of malware beaconing to a C2 server for instructions.
Question 5: Which type of threat intelligence indicator would a CNDA use to identify malicious activity by matching network traffic?
- CVE identifier
- Indicator of Compromise (IoC) such as a malicious IP or domain (Correct answer)
- CVSS score
- CIS benchmark control
Correct answer: Indicator of Compromise (IoC) such as a malicious IP or domain
IoCs such as malicious IPs, domains, hashes, and URL patterns can be fed into firewalls, IDS, and SIEM to detect known threats.
Question 6: What is a 'playbook' in the context of incident response?
- A vendor-supplied patch guide
- A documented, step-by-step procedure for responding to a specific type of incident (Correct answer)
- A list of authorized users
- A network diagram
Correct answer: A documented, step-by-step procedure for responding to a specific type of incident
A playbook provides predefined, repeatable procedures so responders take consistent, effective action when a specific incident type occurs.
CNDA Intrusion Detection and Incident Response 1
According to NIST SP 800-61, what are the four phases of the incident response lifecycle?