Detect and Respond to Cyber Incidents Flashcards

Which of the following BEST describes the purpose of a playbook in incident response?

Answer: A predefined, step-by-step procedure for responding to a specific type of incident

Incident response playbooks provide step-by-step procedures tailored to specific threat scenarios, ensuring consistent and efficient response.

An analyst finds a scheduled task on a compromised Windows host that runs a Base64-encoded PowerShell command at 3 AM daily. This MOST likely represents which attacker technique?

Answer: Persistence via scheduled task with obfuscated payload

Scheduled tasks with Base64-encoded PowerShell are a common persistence mechanism that allows attackers to maintain access and execute code periodically.

What is the role of a 'chain of custody' during incident response?

Answer: To track the handling of digital evidence to ensure its integrity and admissibility

Chain of custody documents who handled evidence, when, and how, ensuring its integrity is maintained for potential legal proceedings.

Which network-based indicator MOST strongly suggests an ongoing data exfiltration event?

Answer: Large outbound data transfers to an unfamiliar external IP at unusual hours

Anomalous large outbound data transfers to unknown external destinations at off-hours are a strong indicator of active data exfiltration.

When should an organization involve law enforcement during a cyber incident?

Answer: When the incident involves criminal activity, nation-state actors, or regulatory requirements mandate it

Law enforcement should be engaged when incidents involve criminal activity, critical infrastructure attacks, or regulations (like financial sector rules) require mandatory reporting.

What is the MITRE ATT&CK framework primarily used for in incident detection and response?

Answer: Mapping adversary tactics, techniques, and procedures to improve detection and response

MITRE ATT&CK provides a structured knowledge base of adversary TTPs that organizations use to improve threat detection, gap analysis, and response procedures.

A web server log shows requests containing '../../../etc/passwd' in the URL parameter. What type of attack does this indicate?

Answer: Directory traversal (path traversal)

The '../' sequences in URL parameters are signatures of directory traversal attacks, where attackers attempt to access files outside the web root.