CSX Detect and Respond to Cyber Incidents 3 — Questions and Answers
Question 1: What is the FIRST action an incident responder should take upon discovering an active ransomware infection on a corporate workstation?
- Pay the ransom to recover files quickly
- Isolate the infected system from the network immediately (Correct answer)
- Reimage the system from a clean backup
- Contact law enforcement before doing anything else
Correct answer: Isolate the infected system from the network immediately
Immediate network isolation prevents ransomware from spreading to other systems and shared network drives while preserving evidence.
Question 2: Which artifact would BEST help determine the initial access vector used in a Windows intrusion?
- Prefetch files
- Windows Error Reporting logs
- Security Event Log with logon events and PowerShell logging (Correct answer)
- Registry Run keys
Correct answer: Security Event Log with logon events and PowerShell logging
Security Event Logs combined with PowerShell logging capture authentication attempts, script execution, and other initial access indicators on Windows systems.
Question 3: A SOC analyst notices an internal host making connections to 47 different external IPs on port 445 in 10 minutes. What is the MOST likely explanation?
- Normal file sharing activity
- The host is infected with a worm scanning for SMB vulnerabilities (Correct answer)
- A scheduled backup job running
- A legitimate vulnerability scanner
Correct answer: The host is infected with a worm scanning for SMB vulnerabilities
Rapid outbound SMB (port 445) connection attempts to multiple external IPs is characteristic of a worm like WannaCry propagating and scanning for vulnerable hosts.
Question 4: What is a 'threat indicator' in the context of cyber incident detection?
- A vulnerability score from CVSS
- An observable artifact such as an IP, domain, hash, or behavior associated with malicious activity (Correct answer)
- A risk rating assigned by a security vendor
- A user's anomalous login time
Correct answer: An observable artifact such as an IP, domain, hash, or behavior associated with malicious activity
Threat indicators (also called IoCs) are observable artifacts—IPs, domains, file hashes, registry keys—linked to known malicious activity used to detect threats.
Question 5: During eradication, why is it important to identify ALL affected systems before removing malware?
- To calculate the total cost of the incident
- To ensure the attacker cannot re-establish access from an overlooked compromised host (Correct answer)
- To satisfy regulatory reporting requirements
- To determine whether to pay a ransom
Correct answer: To ensure the attacker cannot re-establish access from an overlooked compromised host
Failing to identify every compromised system allows attackers to maintain a foothold and re-infect cleaned systems, making eradication ineffective.
Question 6: Which tool category is MOST commonly used to correlate security events from multiple sources and generate alerts?
- Vulnerability scanner
- SIEM (Security Information and Event Management) (Correct answer)
- Password manager
- Network access control (NAC)
Correct answer: SIEM (Security Information and Event Management)
A SIEM aggregates and correlates log data from multiple sources to identify patterns and generate actionable security alerts.
Question 7: What is 'dwell time' in the context of cybersecurity incidents?
- The time an analyst spends investigating an alert
- The duration between initial compromise and detection of the breach (Correct answer)
- The time required to patch a vulnerability after disclosure
- The delay between detection and containment
Correct answer: The duration between initial compromise and detection of the breach
Dwell time measures how long an attacker remains undetected in an environment after initial compromise, with shorter dwell times indicating better detection capabilities.
CSX Detect and Respond to Cyber Incidents 3
What is the FIRST action an incident responder should take upon discovering an active ransomware infection on a corporate workstation?