Cyber Security Incident Response 3

Question 1

What does MTTR stand for in incident response metrics?

Accepted Answer

Mean Time to Respond or Recover

Answer

MTTR (Mean Time to Respond/Recover) measures the average time to contain and resolve a security incident.

Question 2

Which artifact should be preserved immediately when ransomware is detected on a system?

Accepted Answer

A forensic memory and disk image before shutdown

Answer

Capturing memory and disk images before shutdown preserves volatile forensic evidence and encryption key artifacts.

Question 3

What is a playbook in the context of incident response?

Accepted Answer

A documented step-by-step procedure for responding to a specific type of incident

Answer

An incident response playbook provides step-by-step guidance for handling a specific incident type consistently.

Question 4

Which framework provides a structured vocabulary for describing attacker tactics, techniques, and procedures (TTPs)?

Accepted Answer

MITRE ATT&CK

Answer

MITRE ATT&CK is a globally accessible knowledge base of real-world attacker TTPs used for threat detection and response.

Question 5

What is the difference between an incident and an event in cybersecurity?

Accepted Answer

An event is any observable occurrence; an incident is an event with negative security implications

Answer

An event is any observable system activity, while an incident is an event that violates security policies or poses a threat.

Cyber Security Practice Test