CSC Audit, Monitoring & Incident Response 2 — Questions and Answers
Question 1: Which log retention period is typically required by PCI DSS for audit logs?
- 30 days online, 90 days archived
- 90 days online, 1 year archived (Correct answer)
- 3 months online, 6 months archived
- 6 months online, 2 years archived
Correct answer: 90 days online, 1 year archived
PCI DSS requires audit logs to be retained for at least 12 months, with the most recent 3 months immediately available for analysis.
Question 2: A SIEM alert fires on 500 events per hour but the SOC analyst finds most are false positives. What is the BEST corrective action?
- Disable the alert rule to reduce noise
- Tune the detection rule with additional context filters (Correct answer)
- Escalate all alerts to Tier 2 for review
- Increase the alert threshold to suppress low-severity events
Correct answer: Tune the detection rule with additional context filters
Tuning detection rules with additional context filters reduces false positives while preserving detection of genuine threats.
Question 3: During an incident, the IR team needs to preserve volatile memory evidence. Which action should be performed FIRST?
- Power off the system immediately
- Run a full disk image
- Capture a live memory dump before any other action (Correct answer)
- Disconnect the system from the network
Correct answer: Capture a live memory dump before any other action
Volatile memory is lost on power-off, so capturing a live memory dump must occur before other evidence collection or shutdown.
Question 4: What is the PRIMARY purpose of a lessons-learned meeting after a security incident?
- Assign blame to responsible individuals
- Document evidence for legal proceedings
- Identify process gaps and improve future response (Correct answer)
- Notify regulators of the breach
Correct answer: Identify process gaps and improve future response
Lessons-learned meetings focus on identifying gaps in detection, response, and controls to continuously improve the incident response process.
Question 5: Which metric BEST measures the effectiveness of an incident response program over time?
- Number of security tools deployed
- Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR) (Correct answer)
- Total number of incidents reported
- Size of the incident response team
Correct answer: Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR)
MTTD and MTTR directly measure how quickly threats are identified and contained, reflecting IR program maturity.
Question 6: An auditor requests evidence that privileged user activity is being monitored. Which control BEST satisfies this requirement?
- Requiring privileged users to sign an acceptable use policy
- Implementing a Privileged Access Management (PAM) solution with session recording (Correct answer)
- Conducting annual security awareness training for admins
- Enforcing strong password policies for privileged accounts
Correct answer: Implementing a Privileged Access Management (PAM) solution with session recording
PAM solutions with session recording provide direct evidence of privileged activity monitoring, including command logs and video playback.
Question 7: Which incident classification category describes an event where sensitive data has been confirmed as accessed by an unauthorized party?
- Security event
- Security incident
- Data breach (Correct answer)
- Near miss
Correct answer: Data breach
A data breach specifically involves confirmed unauthorized access to sensitive data, distinguishing it from a general security incident.
CSC Audit, Monitoring & Incident Response 2
Which log retention period is typically required by PCI DSS for audit logs?