Cyber Security Incident Response 2

Question 1

What does IOC stand for in cybersecurity incident response?

Accepted Answer

Indicator of Compromise

Answer

Index of Compromise

Answer

Incident Operations Center

Answer

Input-Output Control

Question 2

Which log source is most useful for detecting unauthorized privilege escalation on a Windows system?

Accepted Answer

Windows Security Event Log

Answer

DNS query logs

Answer

Web server access logs

Answer

DHCP lease logs

Question 3

What is a SIEM system used for in incident response?

Accepted Answer

Aggregating and correlating security logs to detect threats and support investigations

Answer

Encrypting sensitive data at rest

Answer

Managing firewall policy deployments

Answer

Conducting vulnerability scans across the network

Question 4

What is memory forensics used to uncover during incident response?

Accepted Answer

Running processes, injected code, and encryption keys in volatile RAM

Answer

Deleted files on a hard drive

Answer

Network firewall rule changes

Answer

Web browser history from last month

Question 5

What is lateral movement detection typically based on in a SIEM?

Accepted Answer

Anomalous authentication events and unusual access patterns across internal systems

Answer

High CPU usage on a server

Answer

Slow network throughput on WAN links

Answer

Increased DNS query volume from a workstation

Question 6

What is the purpose of a tabletop exercise in incident response?

Accepted Answer

Simulate an incident scenario to test and improve the response plan without affecting production

Answer

Deploy patches to production systems

Answer

Conduct a live red team attack against the organization

Answer

Review the firewall configuration for misconfigurations