CSS Incident Response & Recovery 3 — Questions and Answers
Question 1: Which NIST SP 800-61 phase focuses on minimizing damage and preventing further unauthorized access?
- Detection and Analysis
- Containment, Eradication, and Recovery (Correct answer)
- Post-Incident Activity
- Preparation
Correct answer: Containment, Eradication, and Recovery
The Containment, Eradication, and Recovery phase directly addresses stopping the attack, removing threats, and restoring affected systems.
Question 2: An IR analyst needs to capture volatile memory from a live compromised system. Which tool is BEST suited for this task?
- FTK Imager (disk imaging)
- Winpmem or DumpIt for memory acquisition (Correct answer)
- Wireshark for packet capture
- Autopsy for file analysis
Correct answer: Winpmem or DumpIt for memory acquisition
Winpmem and DumpIt are purpose-built for acquiring physical memory from live Windows systems without disrupting running processes.
Question 3: What is the difference between an Incident Response Plan (IRP) and a Business Continuity Plan (BCP)?
- IRP focuses on restoring IT systems; BCP focuses on security event investigation
- IRP addresses security event response; BCP ensures critical business functions continue during disruptions (Correct answer)
- IRP and BCP are identical documents with different names
- IRP is for physical incidents; BCP is for cyber incidents only
Correct answer: IRP addresses security event response; BCP ensures critical business functions continue during disruptions
An IRP governs how to respond to and recover from security incidents, while a BCP ensures essential business operations continue under any disruptive condition.
Question 4: During eradication, a team removes malware but fails to identify all persistence mechanisms. Which outcome is MOST likely?
- The attacker loses all access permanently
- Reinfection occurs as the attacker re-establishes access via remaining backdoors (Correct answer)
- The incident is considered resolved
- The attacker pivots to physical intrusion methods
Correct answer: Reinfection occurs as the attacker re-establishes access via remaining backdoors
Incomplete eradication leaves surviving persistence mechanisms that allow the attacker to regain access, effectively restarting the incident.
Question 5: Which metric is used to measure the effectiveness of an incident response team's detection capabilities?
- Mean Time to Recover (MTTR)
- Mean Time to Detect (MTTD) (Correct answer)
- Recovery Time Objective (RTO)
- Recovery Point Objective (RPO)
Correct answer: Mean Time to Detect (MTTD)
MTTD measures the average time from when an incident occurs to when it is detected, directly reflecting detection capability effectiveness.
Question 6: An organization wants to test its incident response plan with minimal disruption to operations. Which exercise type is MOST appropriate?
- Full-scale simulation with live system shutdowns
- Tabletop exercise using discussion-based scenarios (Correct answer)
- Parallel test running backup systems simultaneously
- Red team engagement with no restrictions
Correct answer: Tabletop exercise using discussion-based scenarios
Tabletop exercises allow teams to walk through incident scenarios verbally without impacting production systems, making them ideal for low-disruption testing.
Question 7: What is the significance of establishing a 'war room' or dedicated command center during a major security incident?
- It physically isolates the compromised servers
- It centralizes communication and decision-making among response team members (Correct answer)
- It serves as the primary location for evidence storage
- It automates containment actions across the network
Correct answer: It centralizes communication and decision-making among response team members
A war room or command center brings key stakeholders together to enable rapid, coordinated decision-making and clear communication throughout the incident.
CSS Incident Response & Recovery 3
Which NIST SP 800-61 phase focuses on minimizing damage and preventing further unauthorized access?