CSS Incident Response & Recovery 2

Question 1

During the containment phase of incident response, which strategy isolates a compromised host while preserving its network traffic data for forensic analysis?

Accepted Answer

Network-based containment using ACLs or VLAN isolation

Answer

Network-based containment via ACLs or VLAN isolation limits the attacker's lateral movement while keeping the host running for forensic evidence capture.

Question 2

What is the primary purpose of a 'lessons learned' meeting after a security incident?

Accepted Answer

Document what happened and improve future response processes

Answer

The lessons learned meeting captures what worked, what failed, and identifies process improvements to strengthen future incident response.

Question 3

Which chain-of-custody principle is MOST critical when handling digital evidence collected during an incident?

Accepted Answer

Documenting every person who accessed the evidence

Answer

Chain of custody requires a complete, unbroken record of everyone who accessed the evidence to ensure its integrity and admissibility.

Question 4

An IR team discovers that an attacker maintained persistence via a scheduled task. Which recovery step should be performed FIRST?

Accepted Answer

Remove the malicious scheduled task

Answer

Removing the persistence mechanism first ensures the attacker cannot regain access before other remediation steps are completed.

Question 5

What does the term 'dwell time' refer to in the context of incident response?

Accepted Answer

Time between initial compromise and detection

Answer

Dwell time measures how long an attacker remains undetected in the environment, and reducing it is a key metric for IR effectiveness.

(CSS) Certified Security Sentinel Practice Test

(CSS) Certified Security Sentinel Practice Test

CSS Incident Response & Recovery 2