CSC Audit, Monitoring & Incident Response 2

Question 1

Which log retention period is typically required by PCI DSS for audit logs?

Accepted Answer

90 days online, 1 year archived

Answer

PCI DSS requires audit logs to be retained for at least 12 months, with the most recent 3 months immediately available for analysis.

Question 2

A SIEM alert fires on 500 events per hour but the SOC analyst finds most are false positives. What is the BEST corrective action?

Accepted Answer

Tune the detection rule with additional context filters

Answer

Tuning detection rules with additional context filters reduces false positives while preserving detection of genuine threats.

Question 3

During an incident, the IR team needs to preserve volatile memory evidence. Which action should be performed FIRST?

Accepted Answer

Capture a live memory dump before any other action

Answer

Volatile memory is lost on power-off, so capturing a live memory dump must occur before other evidence collection or shutdown.

Question 4

What is the PRIMARY purpose of a lessons-learned meeting after a security incident?

Accepted Answer

Identify process gaps and improve future response

Answer

Lessons-learned meetings focus on identifying gaps in detection, response, and controls to continuously improve the incident response process.

Question 5

Which metric BEST measures the effectiveness of an incident response program over time?

Accepted Answer

Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR)

Answer

MTTD and MTTR directly measure how quickly threats are identified and contained, reflecting IR program maturity.

(CSC) Cybersecurity Compliance Certification Practice Test