Cyber Security Incident Response 3

Question 1

What does MTTR stand for in incident response metrics?

Accepted Answer

Mean Time to Respond or Recover

Answer

Maximum Threat and Tracking Report

Answer

Multi-Tenant Threat Response

Answer

Managed Threat Triage Report

Question 2

Which artifact should be preserved immediately when ransomware is detected on a system?

Accepted Answer

A forensic memory and disk image before shutdown

Answer

Web server configuration files

Answer

Email server logs from the past year

Answer

All user desktop shortcuts

Question 3

What is a playbook in the context of incident response?

Accepted Answer

A documented step-by-step procedure for responding to a specific type of incident

Answer

A database of all known vulnerabilities

Answer

An automated tool for blocking malicious IPs

Answer

A log aggregation configuration file

Question 4

Which framework provides a structured vocabulary for describing attacker tactics, techniques, and procedures (TTPs)?

Accepted Answer

MITRE ATT&CK

Answer

NIST CSF

Answer

OWASP Top 10

Answer

ISO 27001

Question 5

What is the difference between an incident and an event in cybersecurity?

Accepted Answer

An event is any observable occurrence; an incident is an event with negative security implications

Answer

Events are more severe than incidents

Answer

Incidents are automatically resolved; events require manual response

Answer

Events require executive notification; incidents do not

Question 6

What does the term 'dwell time' refer to in a security incident?

Accepted Answer

The duration an attacker remains undetected inside a compromised network

Answer

Time taken to patch a vulnerability after discovery

Answer

Time required to restore systems after a breach

Answer

The delay between alert generation and analyst review