Security Operations and Incident Response Flashcards

Which forensic principle ensures that evidence is protected from alteration from the moment of collection through legal proceedings?

Answer: Chain of custody

Chain of custody documents every person who handles evidence, timestamps all transfers, and verifies integrity, ensuring evidence is admissible and untampered in legal proceedings.

A CASP+ analyst suspects lateral movement via SMB. Which log provides the MOST direct evidence?

Answer: Windows Security Event ID 4624 (logon type 3 — network) across multiple hosts

Event ID 4624 with logon type 3 (network logon) recorded on multiple systems in a short timeframe from the same source account indicates lateral movement via SMB authentication.

Which playbook element is MOST critical for reducing mean time to respond (MTTR) during an incident?

Answer: Pre-defined decision trees with specific containment actions for each alert type

Pre-defined decision trees give responders clear, step-by-step actions for each alert, eliminating decision fatigue and enabling faster, consistent containment and remediation.

An incident responder acquires a forensic image of a suspect hard drive. Which tool and format combination is the industry standard for maintaining forensic integrity?

Answer: FTK Imager or dc3dd to an E01 image with SHA-256 hash verification

E01 (Expert Witness Format) images include embedded hash values that can be verified at any time, and tools like FTK Imager record acquisition metadata for chain-of-custody documentation.

Which indicator MOST strongly suggests that a web server has been compromised rather than experiencing legitimate high traffic?

Answer: Outbound connections from the web server to unknown external IPs on port 443

Outbound connections from a web server to unknown external hosts suggest C2 communication or data exfiltration — web servers should receive requests, not initiate external sessions.

A CASP+ analyst needs to detect credential dumping on Windows endpoints. Which security control provides the MOST direct protection?

Answer: Configuring Credential Guard to isolate LSASS using virtualization-based security

Credential Guard uses VBS to store NTLM hashes and Kerberos tickets in an isolated environment inaccessible to the OS, preventing tools like Mimikatz from dumping credentials from LSASS.