CSC Crisis Management & Incident Response 3 — Questions and Answers
Question 1: Which containment strategy is most appropriate when an organization cannot afford any business disruption during an active incident?
- Hard shutdown of all affected systems
- Short-term containment with monitoring while maintaining operations (Correct answer)
- Full network segmentation and isolation
- Immediate data destruction to prevent further breach
Correct answer: Short-term containment with monitoring while maintaining operations
Short-term containment allows the organization to maintain operations while limiting the spread of an incident through monitoring and targeted controls.
Question 2: An attacker uses a compromised employee account to exfiltrate data over several weeks. Which detection control would MOST likely have identified this earliest?
- Firewall rule updates
- User and Entity Behavior Analytics (UEBA) (Correct answer)
- Antivirus signature scanning
- Penetration testing
Correct answer: User and Entity Behavior Analytics (UEBA)
UEBA detects anomalous behavior patterns compared to a user's baseline, making it effective at catching insider threats and compromised accounts.
Question 3: What is the key difference between a disaster recovery plan (DRP) and a business continuity plan (BCP)?
- DRP covers IT systems recovery; BCP covers broader operational continuity during disruption (Correct answer)
- BCP is only for natural disasters; DRP covers cyberattacks
- DRP is a subset of the incident response plan
- BCP only applies to financial institutions
Correct answer: DRP covers IT systems recovery; BCP covers broader operational continuity during disruption
A DRP focuses on restoring IT systems and data after a disaster, while a BCP encompasses maintaining all critical business functions during and after disruption.
Question 4: When performing memory forensics during incident response, which tool is commonly used to acquire volatile memory from a live Windows system?
- Autopsy
- Wireshark
- WinPmem or DumpIt (Correct answer)
- Nessus
Correct answer: WinPmem or DumpIt
WinPmem and DumpIt are widely used tools for capturing a raw memory image from live Windows systems without shutting them down.
Question 5: A CISO receives a threat intelligence report indicating a zero-day vulnerability is being actively exploited against their industry. What is the BEST immediate crisis response action?
- Wait for the vendor patch before taking action
- Activate the incident response team and apply compensating controls while awaiting a patch (Correct answer)
- Shut down all internet-facing systems indefinitely
- Issue a public statement about the vulnerability
Correct answer: Activate the incident response team and apply compensating controls while awaiting a patch
Activating the IR team and deploying compensating controls (such as WAF rules or network segmentation) provides immediate protection while waiting for an official vendor patch.
Question 6: Which type of malware analysis involves executing a sample in an isolated environment to observe its behavior?
- Static analysis
- Dynamic analysis (Correct answer)
- Signature-based analysis
- Heuristic analysis
Correct answer: Dynamic analysis
Dynamic analysis executes malware in a controlled sandbox to observe real-time behavior such as network connections, file modifications, and registry changes.
Question 7: What does the term 'scope creep' mean in the context of incident response?
- An attacker expanding their foothold across additional systems during response
- The gradual expansion of an investigation beyond its original boundaries (Correct answer)
- Unauthorized personnel joining the response team
- Increasing the number of affected customers over time
Correct answer: The gradual expansion of an investigation beyond its original boundaries
Scope creep in incident response refers to an investigation gradually expanding beyond its originally defined boundaries, consuming additional resources and time.
CSC Crisis Management & Incident Response 3
Which containment strategy is most appropriate when an organization cannot afford any business disruption during an active incident?