Cyber Security Incident Response 2 — Questions and Answers
Question 1: What does IOC stand for in cybersecurity incident response?
- Index of Compromise
- Indicator of Compromise (Correct answer)
- Incident Operations Center
- Input-Output Control
Correct answer: Indicator of Compromise
Indicators of Compromise (IOCs) are artifacts such as malicious IPs, file hashes, or domains that signal a breach.
Question 2: Which log source is most useful for detecting unauthorized privilege escalation on a Windows system?
- DNS query logs
- Windows Security Event Log (Correct answer)
- Web server access logs
- DHCP lease logs
Correct answer: Windows Security Event Log
The Windows Security Event Log records authentication events, privilege use, and account management changes.
Question 3: What is a SIEM system used for in incident response?
- Encrypting sensitive data at rest
- Aggregating and correlating security logs to detect threats and support investigations (Correct answer)
- Managing firewall policy deployments
- Conducting vulnerability scans across the network
Correct answer: Aggregating and correlating security logs to detect threats and support investigations
A SIEM collects logs from multiple sources, correlates events, and alerts on suspicious activity to support incident detection.
Question 4: What is memory forensics used to uncover during incident response?
- Deleted files on a hard drive
- Running processes, injected code, and encryption keys in volatile RAM (Correct answer)
- Network firewall rule changes
- Web browser history from last month
Correct answer: Running processes, injected code, and encryption keys in volatile RAM
Memory forensics analyzes a RAM dump to find running processes, malware artifacts, and data that never touches disk.
Question 5: What is lateral movement detection typically based on in a SIEM?
- High CPU usage on a server
- Anomalous authentication events and unusual access patterns across internal systems (Correct answer)
- Slow network throughput on WAN links
- Increased DNS query volume from a workstation
Correct answer: Anomalous authentication events and unusual access patterns across internal systems
SIEM rules flag unusual authentication patterns, such as a single account logging into many hosts in a short time window.
Question 6: What is the purpose of a tabletop exercise in incident response?
- Deploy patches to production systems
- Simulate an incident scenario to test and improve the response plan without affecting production (Correct answer)
- Conduct a live red team attack against the organization
- Review the firewall configuration for misconfigurations
Correct answer: Simulate an incident scenario to test and improve the response plan without affecting production
Tabletop exercises walk response teams through simulated scenarios to identify gaps in processes and communication.
Cyber Security Incident Response 2
What does IOC stand for in cybersecurity incident response?