CSS Incident Response & Recovery 5

Question 1

When performing root cause analysis (RCA) after an incident, which framework helps identify contributing factors across people, processes, and technology?

Accepted Answer

The 5 Whys or Fishbone (Ishikawa) diagram

Answer

The 5 Whys and Fishbone diagrams are root cause analysis tools that systematically trace failures across human, process, and technical contributing factors.

Question 2

An attacker compromised a build server and inserted malicious code into a software release. Which type of incident does this represent?

Accepted Answer

Supply chain attack

Answer

Compromising a build server to inject malicious code into software releases is a textbook supply chain attack targeting downstream users.

Question 3

During the detection phase, a SIEM generates thousands of alerts but only a small number represent real threats. What challenge does this describe?

Accepted Answer

Alert fatigue due to high false positive rates

Answer

Alert fatigue occurs when security teams are overwhelmed by high volumes of false positive alerts, increasing the risk of missing genuine threats.

Question 4

What is the role of a 'scribe' during a major incident response operation?

Accepted Answer

Documenting actions taken, decisions made, and timeline of events in real time

Answer

The scribe maintains a real-time log of all IR activities, decisions, and timestamps to support post-incident review and potential legal requirements.

Question 5

Which approach to system recovery provides the STRONGEST assurance that malware has been fully removed from a compromised endpoint?

Accepted Answer

Wiping and reimaging the system from a known-good baseline image

Answer

Wiping and reimaging from a trusted baseline eliminates all malware and attacker modifications, providing the highest confidence of full remediation.

(CSS) Certified Security Sentinel Practice Test

(CSS) Certified Security Sentinel Practice Test

CSS Incident Response & Recovery 5