Security Operations and Incident Response Flashcards

During a security incident, a responder discovers malware on a compromised host. What is the FIRST action that should be taken according to incident response best practices?

Answer: Isolate the system from the network while preserving volatile memory

Network isolation stops active exfiltration or C2 communication while preserving volatile memory (RAM) contains critical forensic evidence that is lost on reboot or shutdown.

Which log source is MOST valuable for detecting data exfiltration via DNS tunneling?

Answer: DNS query and response logs with anomaly baselines

DNS tunneling encodes data in DNS query strings; analysis of DNS logs for high-frequency queries, unusual record types, or large TXT responses reveals this technique.

A SOC analyst receives an alert for a possible SQL injection attack. Which evidence BEST confirms successful exploitation?

Answer: Database error messages followed by unexpected data in HTTP responses

Database error messages in responses indicate the application is processing injected SQL, and unexpected data in the response confirms the attacker retrieved data from the database.

Which incident response phase involves identifying lessons learned and updating security controls to prevent recurrence?

Answer: Post-Incident Activity

The Post-Incident Activity phase (NIST SP 800-61) includes a lessons-learned meeting, updating incident response plans, and implementing improvements to prevent similar incidents.

A threat hunter is looking for living-off-the-land (LotL) attacks. Which data source provides the MOST visibility into these techniques?

Answer: Process creation and command-line logging (Sysmon Event ID 1)

LotL attacks use legitimate system tools (PowerShell, WMI, certutil); Sysmon process creation logs capture command-line arguments that reveal malicious use of trusted binaries.

Which technique allows an attacker to maintain persistence on a Windows system by hijacking the loading of DLLs?

Answer: DLL search order hijacking

DLL search order hijacking places a malicious DLL in a directory that Windows searches before the legitimate DLL location, causing the malicious code to load with the application's privileges.