CSOC Threat Detection and Incident Response — Questions and Answers
Question 1: What are the typical phases of a cybersecurity incident response lifecycle?
- Preparation, Detection and Analysis, Containment, Eradication, Recovery, and Post-Incident Review (Correct answer)
- Discovery, Escalation, Remediation, and Sign-off
- Alert, Triage, Patch, Report, and Close
- Identify, Protect, Detect, Respond, and Recover
Correct answer: Preparation, Detection and Analysis, Containment, Eradication, Recovery, and Post-Incident Review
The standard incident response lifecycle includes six phases: Preparation (planning and tools), Detection and Analysis (identifying the incident), Containment (limiting spread), Eradication (removing the threat), Recovery (restoring systems), and Post-Incident Review (lessons learned).
Question 2: What is a Security Information and Event Management (SIEM) system used for in a CSOC?
- Aggregating and correlating security event logs from multiple sources to detect threats and support incident response (Correct answer)
- Managing physical security access to the CSOC facility
- Storing backup copies of all organisational data for disaster recovery
- Automating the deployment of security patches across the network
Correct answer: Aggregating and correlating security event logs from multiple sources to detect threats and support incident response
A SIEM collects, aggregates, and correlates log data and security events from across an organisation's IT infrastructure, providing security analysts with a unified view to detect anomalies, identify threats, and investigate incidents.
Question 3: What is an Indicator of Compromise (IoC) in threat detection?
- Evidence found in a network or system that suggests a security breach or malicious activity may have occurred (Correct answer)
- A legal indicator that a company is not compliant with cybersecurity regulations
- A financial metric indicating that a company's cybersecurity budget has been compromised
- A software tool used to detect and isolate malware on endpoint devices
Correct answer: Evidence found in a network or system that suggests a security breach or malicious activity may have occurred
IoCs are artifacts or pieces of evidence, such as unusual network traffic, specific file hashes, IP addresses, or registry changes, that indicate a system may have been compromised. They are used to detect and investigate potential security incidents.
Question 4: What is the difference between a security event and a security incident?
- A security event is any observable occurrence; a security incident is an event that adversely affects security or violates a security policy (Correct answer)
- A security event is always serious; a security incident is a minor occurrence not requiring response
- Security events are external threats; security incidents are internal breaches only
- There is no distinction — both terms describe confirmed attacks on a system
Correct answer: A security event is any observable occurrence; a security incident is an event that adversely affects security or violates a security policy
A security event is any observable occurrence in a system or network that may or may not be malicious. A security incident is a confirmed event that has actually violated security policies, caused harm, or required a formal response.
Question 5: What is 'containment' in the context of cybersecurity incident response?
- Actions taken to limit the spread and impact of an active security incident while preserving evidence for investigation (Correct answer)
- Permanently removing all traces of malware from affected systems
- Preventing users from accessing the internet during a security investigation
- Notifying affected users that their data may have been compromised
Correct answer: Actions taken to limit the spread and impact of an active security incident while preserving evidence for investigation
Containment stops the incident from spreading further while preserving evidence for forensic analysis. It may involve isolating affected systems from the network, blocking malicious traffic, or disabling compromised accounts.
Question 6: What is the purpose of a post-incident review (PIR) after a cybersecurity incident?
- To identify what happened, why it happened, and how to improve detection, response, and prevention for the future (Correct answer)
- To determine who is legally liable for the incident and initiate disciplinary action
- To inform the public and media about the details of the security breach
- To restore all affected systems to their pre-incident state
Correct answer: To identify what happened, why it happened, and how to improve detection, response, and prevention for the future
A post-incident review is a structured analysis of the incident and the response. Its purpose is to learn from the incident — understanding root causes, evaluating the effectiveness of the response, and identifying improvements to prevent or better handle future incidents.
CSOC Threat Detection and Incident Response
What are the typical phases of a cybersecurity incident response lifecycle?