CSX Detect and Respond to Cyber Incidents 3

Question 1

What is the FIRST action an incident responder should take upon discovering an active ransomware infection on a corporate workstation?

Accepted Answer

Isolate the infected system from the network immediately

Answer

Immediate network isolation prevents ransomware from spreading to other systems and shared network drives while preserving evidence.

Question 2

Which artifact would BEST help determine the initial access vector used in a Windows intrusion?

Accepted Answer

Security Event Log with logon events and PowerShell logging

Answer

Security Event Logs combined with PowerShell logging capture authentication attempts, script execution, and other initial access indicators on Windows systems.

Question 3

A SOC analyst notices an internal host making connections to 47 different external IPs on port 445 in 10 minutes. What is the MOST likely explanation?

Accepted Answer

The host is infected with a worm scanning for SMB vulnerabilities

Answer

Rapid outbound SMB (port 445) connection attempts to multiple external IPs is characteristic of a worm like WannaCry propagating and scanning for vulnerable hosts.

Question 4

What is a 'threat indicator' in the context of cyber incident detection?

Accepted Answer

An observable artifact such as an IP, domain, hash, or behavior associated with malicious activity

Answer

Threat indicators (also called IoCs) are observable artifacts—IPs, domains, file hashes, registry keys—linked to known malicious activity used to detect threats.

Question 5

During eradication, why is it important to identify ALL affected systems before removing malware?

Accepted Answer

To ensure the attacker cannot re-establish access from an overlooked compromised host

Answer

Failing to identify every compromised system allows attackers to maintain a foothold and re-infect cleaned systems, making eradication ineffective.

(CSX) Cybersecurity Nexus Certification Practice Test

(CSX) Cybersecurity Nexus Certification Practice Test

CSX Detect and Respond to Cyber Incidents 3