Cyber Security Jobs Incident Response and Digital Forensics 2 — Questions and Answers
Question 1: Which log source is typically first analyzed when investigating a Windows compromise?
- Windows Event Logs (Correct answer)
- CSS stylesheets
- PDF documents
- Printer spool files
Correct answer: Windows Event Logs
Windows Event Logs (Security, System, Application) record logon events, process creation, and policy changes, making them the primary investigation source.
Question 2: What does IOC stand for in threat investigation?
- Indicator of Compromise (Correct answer)
- Internal Operations Center
- Internet Outage Condition
- Index of Controls
Correct answer: Indicator of Compromise
An IOC (Indicator of Compromise) is a piece of forensic data such as a file hash, IP address, or domain that indicates a system may have been breached.
Question 3: What is volatile memory and why must it be captured first in forensics?
- RAM data that disappears when power is lost, containing running processes and network connections (Correct answer)
- Encrypted file system data
- BIOS firmware settings
- Static hard drive content
Correct answer: RAM data that disappears when power is lost, containing running processes and network connections
Volatile memory (RAM) contains running processes, network connections, and encryption keys that are lost when a system is powered off, so it must be captured before shutdown.
Question 4: What is the purpose of a post-incident review (PIR)?
- Document lessons learned to improve future incident response (Correct answer)
- Reformat all affected hard drives
- Terminate employees involved in the incident
- Notify all users to change passwords immediately
Correct answer: Document lessons learned to improve future incident response
A PIR identifies what worked, what failed, and what improvements should be made to prevent recurrence and strengthen the incident response process.
Question 5: Which phase comes immediately after containment in most IR frameworks?
- Eradication (Correct answer)
- Preparation
- Post-incident activity
- Detection
Correct answer: Eradication
After containing an incident, the eradication phase focuses on removing malware, closing attack vectors, and eliminating the threat from the environment.
Question 6: What is a runbook in incident response?
- A documented step-by-step procedure for responding to specific incident types (Correct answer)
- A log of all network packets captured
- A database of known malware hashes
- A physical notebook used by on-call engineers
Correct answer: A documented step-by-step procedure for responding to specific incident types
A runbook provides pre-written, step-by-step instructions for handling specific incident types, enabling faster and more consistent response.
Cyber Security Jobs Incident Response and Digital Forensics 2
Which log source is typically first analyzed when investigating a Windows compromise?