Cyber Security Jobs Incident Response and Digital Forensics 2

Question 1

Which log source is typically first analyzed when investigating a Windows compromise?

Accepted Answer

Windows Event Logs

Answer

Windows Event Logs (Security, System, Application) record logon events, process creation, and policy changes, making them the primary investigation source.

Question 2

What does IOC stand for in threat investigation?

Accepted Answer

Indicator of Compromise

Answer

An IOC (Indicator of Compromise) is a piece of forensic data such as a file hash, IP address, or domain that indicates a system may have been breached.

Question 3

What is volatile memory and why must it be captured first in forensics?

Accepted Answer

RAM data that disappears when power is lost, containing running processes and network connections

Answer

Volatile memory (RAM) contains running processes, network connections, and encryption keys that are lost when a system is powered off, so it must be captured before shutdown.

Question 4

What is the purpose of a post-incident review (PIR)?

Accepted Answer

Document lessons learned to improve future incident response

Answer

A PIR identifies what worked, what failed, and what improvements should be made to prevent recurrence and strengthen the incident response process.

Question 5

Which phase comes immediately after containment in most IR frameworks?

Accepted Answer

Eradication

Answer

After containing an incident, the eradication phase focuses on removing malware, closing attack vectors, and eliminating the threat from the environment.

Cyber Security Jobs Practice Test

Cyber Security Jobs Practice Test

Cyber Security Jobs Incident Response and Digital Forensics 2