CSX Security Operations Center (SOC) Operations 3

Question 1

What is the first phase of the incident response lifecycle according to NIST SP 800-61?

Accepted Answer

Preparation

Answer

NIST SP 800-61 defines Preparation as the first phase, focusing on building incident response capabilities before any incident occurs.

Question 2

In incident response, what does 'containment' refer to?

Accepted Answer

Limiting the spread and impact of an active security incident to prevent further damage

Answer

Containment focuses on isolating affected systems or blocking attacker activity to stop the incident from spreading before full remediation begins.

Question 3

Which document provides step-by-step procedural guidance for SOC analysts responding to a specific incident type?

Accepted Answer

Runbook or playbook

Answer

Runbooks and playbooks are pre-written procedural guides that walk analysts through the exact steps to take when responding to specific incident scenarios.

Question 4

What is the primary goal of a post-incident review (PIR) or lessons-learned session?

Accepted Answer

To identify what worked, what failed, and how to improve future incident response capabilities

Answer

A PIR analyzes the incident response process to surface improvements that strengthen detection, response, and prevention for future events.

Question 5

What is 'threat hunting' in SOC operations?

Accepted Answer

Proactively searching networks and endpoints for threats that have evaded automated detection

Answer

Threat hunting is a proactive, human-driven activity where analysts manually investigate systems to uncover stealthy threats that bypassed automated tools.

(CSX) Cybersecurity Nexus Certification Practice Test

(CSX) Cybersecurity Nexus Certification Practice Test

CSX Security Operations Center (SOC) Operations 3