Cyber Security Incident Response 1 — Questions and Answers
Question 1: What is the first step in the NIST incident response lifecycle?
- Detection and Analysis
- Preparation (Correct answer)
- Containment
- Post-Incident Activity
Correct answer: Preparation
Preparation is the first phase in NIST SP 800-61's incident response lifecycle, establishing policies, teams, and tools.
Question 2: What does containment in incident response aim to achieve?
- Identify the root cause of the incident
- Limit the spread and damage of the incident (Correct answer)
- Restore systems to normal operations
- Document all evidence for legal proceedings
Correct answer: Limit the spread and damage of the incident
Containment stops the incident from spreading to additional systems while the organization investigates and plans recovery.
Question 3: What is the primary goal of the eradication phase in incident response?
- Notify law enforcement of the attack
- Remove the threat from all affected systems (Correct answer)
- Restore backups and resume business operations
- Conduct a lessons-learned review
Correct answer: Remove the threat from all affected systems
Eradication removes malware, closes vulnerabilities, and eliminates all traces of the attacker from affected systems.
Question 4: What is a chain of custody in digital forensics?
- The order in which malware spreads across a network
- Documentation tracking evidence handling from collection to court presentation (Correct answer)
- A checklist for incident response procedures
- The sequence of events in a security incident
Correct answer: Documentation tracking evidence handling from collection to court presentation
Chain of custody documents who handled digital evidence, when, and how, preserving its integrity for legal proceedings.
Question 5: What type of malware encrypts victim files and demands payment for the decryption key?
- Spyware
- Ransomware (Correct answer)
- Rootkit
- Adware
Correct answer: Ransomware
Ransomware encrypts files on infected systems and demands payment (usually cryptocurrency) for the decryption key.
Question 6: What is the purpose of a post-incident review (lessons learned)?
- Re-image all affected systems
- Analyze the incident to improve future response capabilities (Correct answer)
- File criminal charges against attackers
- Restore data from the most recent backup
Correct answer: Analyze the incident to improve future response capabilities
A post-incident review identifies what went wrong, what worked, and how to improve processes for future incidents.
Cyber Security Incident Response 1
What is the first step in the NIST incident response lifecycle?