Cyber Security Jobs Incident Response and Digital Forensics

Question 1

What are the standard phases of the NIST incident response lifecycle?

Accepted Answer

Preparation, Detection & Analysis, Containment/Eradication/Recovery, Post-Incident Activity

Answer

Plan, Do, Check, Act

Answer

Identify, Protect, Detect, Respond, Recover

Answer

Assess, Mitigate, Monitor, Report

Question 2

What is the primary goal of the 'containment' phase in incident response?

Accepted Answer

Prevent the incident from spreading to additional systems

Answer

Identify the root cause of the attack

Answer

Restore systems to normal operations

Answer

Document lessons learned

Question 3

What does chain of custody mean in digital forensics?

Accepted Answer

Documented record tracking who handled evidence and when

Answer

A blockchain-based authentication protocol

Answer

A sequence of firewall rules

Answer

A method for encrypting forensic disk images

Question 4

Which tool is commonly used to create a forensic bit-for-bit image of a hard drive?

Accepted Answer

dd or FTK Imager

Answer

Microsoft Word

Answer

nmap

Answer

Wireshark

Question 5

What is a SIEM system used for in incident response?

Accepted Answer

Aggregating and correlating security logs to detect incidents

Answer

Managing employee HR records

Answer

Encrypting database backups

Answer

Monitoring physical building access

Question 6

What is triage in the context of incident response?

Accepted Answer

Prioritizing incidents based on severity and business impact

Answer

Wiping compromised systems immediately

Answer

Notifying media about a breach

Answer

Patching all systems simultaneously