Cyber Security Incident Response 2

Question 1

What does IOC stand for in cybersecurity incident response?

Accepted Answer

Indicator of Compromise

Answer

Indicators of Compromise (IOCs) are artifacts such as malicious IPs, file hashes, or domains that signal a breach.

Question 2

Which log source is most useful for detecting unauthorized privilege escalation on a Windows system?

Accepted Answer

Windows Security Event Log

Answer

The Windows Security Event Log records authentication events, privilege use, and account management changes.

Question 3

What is a SIEM system used for in incident response?

Accepted Answer

Aggregating and correlating security logs to detect threats and support investigations

Answer

A SIEM collects logs from multiple sources, correlates events, and alerts on suspicious activity to support incident detection.

Question 4

What is memory forensics used to uncover during incident response?

Accepted Answer

Running processes, injected code, and encryption keys in volatile RAM

Answer

Memory forensics analyzes a RAM dump to find running processes, malware artifacts, and data that never touches disk.

Question 5

What is lateral movement detection typically based on in a SIEM?

Accepted Answer

Anomalous authentication events and unusual access patterns across internal systems

Answer

SIEM rules flag unusual authentication patterns, such as a single account logging into many hosts in a short time window.

Cyber Security Practice Test