CSC Incident Response and Reporting 3 — Questions and Answers
Question 1: An organization discovers that an attacker exfiltrated customer credit card data three weeks ago. Under PCI DSS, which entity must be notified immediately?
- Only the affected customers
- The acquiring bank and card brands (Correct answer)
- The FBI Cyber Division
- NIST
Correct answer: The acquiring bank and card brands
PCI DSS requires merchants to notify their acquiring bank (and through them the card brands) immediately upon discovering a cardholder data compromise.
Question 2: What is the primary goal of the 'eradication' phase in the incident response lifecycle?
- Notify affected users of the breach
- Remove the root cause and all traces of the threat from the environment (Correct answer)
- Restore systems to normal operation
- Document the timeline of the attack
Correct answer: Remove the root cause and all traces of the threat from the environment
Eradication focuses on eliminating the threat actor's foothold, malware, and any backdoors before systems are restored to production.
Question 3: A security analyst notices unusual outbound traffic at 2 AM. Before escalating, they should first:
- Shut down the affected server immediately
- Verify whether the traffic is part of scheduled maintenance or legitimate business activity (Correct answer)
- Call law enforcement to report the suspicious activity
- Delete the logs to prevent data exposure
Correct answer: Verify whether the traffic is part of scheduled maintenance or legitimate business activity
Verifying context before escalation prevents false positives and ensures the response effort is proportionate to an actual threat.
Question 4: Which type of incident response team model uses internal staff who handle incidents as a secondary duty alongside their primary roles?
- Centralized CSIRT
- Distributed CSIRT
- Virtual CSIRT (Correct answer)
- Coordinating CSIRT
Correct answer: Virtual CSIRT
A Virtual CSIRT has no dedicated full-time members; instead, staff from various departments respond to incidents on an on-call basis.
Question 5: Under NY SHIELD Act, businesses must notify affected New York residents of a breach affecting their private information within:
- 24 hours of discovery
- As expediently as possible without unreasonable delay (Correct answer)
- 60 days of discovery
- 90 days of discovery
Correct answer: As expediently as possible without unreasonable delay
The NY SHIELD Act requires notification in the most expedient time possible and without unreasonable delay, rather than setting a fixed deadline.
Question 6: In incident response, 'indicators of compromise' (IOCs) are best described as:
- Security policies violated by employees
- Observable artifacts that suggest a system has been breached (Correct answer)
- Vulnerabilities discovered during penetration testing
- Compliance gaps identified in an audit
Correct answer: Observable artifacts that suggest a system has been breached
IOCs are forensic evidence such as unusual IP addresses, file hashes, or registry keys that indicate a host or network has been compromised.
Question 7: Which log source is most useful for detecting unauthorized lateral movement within an enterprise network?
- Web server access logs
- Windows Security Event Logs (authentication events) (Correct answer)
- DNS query logs from external resolvers
- Email gateway spam filter logs
Correct answer: Windows Security Event Logs (authentication events)
Windows Security Event Logs record authentication events such as failed logins and account usage, making them critical for detecting lateral movement via credential abuse.
CSC Incident Response and Reporting 3
An organization discovers that an attacker exfiltrated customer credit card data three weeks ago.
Under PCI DSS, which entity must be notified immediately?