Detect and Respond to Cyber Incidents Flashcards

What is 'purple teaming' in the context of cyber incident detection?

Answer: A collaborative exercise where red team attackers and blue team defenders work together to improve detection capabilities

Purple teaming combines offensive (red team) and defensive (blue team) functions to maximize the feedback loop and measurably improve detection and response capabilities.

Which of the following is a key difference between an 'event' and an 'incident' in cybersecurity?

Answer: An event is any observable occurrence; an incident is an event that negatively affects or threatens security

Every security incident begins as an event, but not every event becomes an incident—an incident is specifically an event with adverse security implications.

An analyst is reviewing NetFlow data and notices a host sending 50MB to an external IP but only receiving 2KB in return. What does this asymmetric pattern MOST likely indicate?

Answer: Data exfiltration from the internal host to an external server

Significantly higher outbound than inbound traffic to an unfamiliar external IP is a classic data exfiltration pattern, as stolen data is being sent out.

Which technique do attackers use to blend malicious traffic with legitimate communications and avoid detection?

Answer: Living off the land (LotL) and using trusted protocols like HTTPS for C2

Living-off-the-land techniques use trusted tools and protocols (like HTTPS, DNS) for C2 communications, making malicious traffic difficult to distinguish from legitimate traffic.

What is the PRIMARY advantage of using threat intelligence feeds in a SOC environment?

Answer: They provide current IoCs and TTPs to proactively detect known threats before they cause damage

Threat intelligence feeds supply timely IoCs and adversary TTPs that enable SOC analysts to proactively hunt for and detect active threat campaigns in their environment.

After fully recovering from a ransomware incident, what is the MOST important preventive control to implement to reduce recurrence risk?

Answer: Implement offline, tested, immutable backups and user security awareness training

Offline immutable backups ensure recovery without paying ransom, while security awareness training addresses the phishing and social engineering vectors ransomware commonly exploits.

During a forensic investigation, an analyst wants to ensure a disk image is an exact copy of the original evidence. Which method is used to verify this?

Answer: Generating and comparing cryptographic hash values (MD5/SHA-256) of the original and copy

Cryptographic hashing (MD5, SHA-1, or SHA-256) produces a unique fingerprint of the data; matching hashes on original and copy confirm bit-for-bit integrity of the forensic image.