CSS Incident Response & Recovery 3

Question 1

Which NIST SP 800-61 phase focuses on minimizing damage and preventing further unauthorized access?

Accepted Answer

Containment, Eradication, and Recovery

Answer

The Containment, Eradication, and Recovery phase directly addresses stopping the attack, removing threats, and restoring affected systems.

Question 2

An IR analyst needs to capture volatile memory from a live compromised system. Which tool is BEST suited for this task?

Accepted Answer

Winpmem or DumpIt for memory acquisition

Answer

Winpmem and DumpIt are purpose-built for acquiring physical memory from live Windows systems without disrupting running processes.

Question 3

What is the difference between an Incident Response Plan (IRP) and a Business Continuity Plan (BCP)?

Accepted Answer

IRP addresses security event response; BCP ensures critical business functions continue during disruptions

Answer

An IRP governs how to respond to and recover from security incidents, while a BCP ensures essential business operations continue under any disruptive condition.

Question 4

During eradication, a team removes malware but fails to identify all persistence mechanisms. Which outcome is MOST likely?

Accepted Answer

Reinfection occurs as the attacker re-establishes access via remaining backdoors

Answer

Incomplete eradication leaves surviving persistence mechanisms that allow the attacker to regain access, effectively restarting the incident.

Question 5

Which metric is used to measure the effectiveness of an incident response team's detection capabilities?

Accepted Answer

Mean Time to Detect (MTTD)

Answer

MTTD measures the average time from when an incident occurs to when it is detected, directly reflecting detection capability effectiveness.

(CSS) Certified Security Sentinel Practice Test

(CSS) Certified Security Sentinel Practice Test

CSS Incident Response & Recovery 3