Cyber Security Jobs Incident Response and Digital Forensics 1 — Questions and Answers
Question 1: What are the standard phases of the NIST incident response lifecycle?
- Preparation, Detection & Analysis, Containment/Eradication/Recovery, Post-Incident Activity (Correct answer)
- Plan, Do, Check, Act
- Identify, Protect, Detect, Respond, Recover
- Assess, Mitigate, Monitor, Report
Correct answer: Preparation, Detection & Analysis, Containment/Eradication/Recovery, Post-Incident Activity
NIST SP 800-61 defines four phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity.
Question 2: What is the primary goal of the 'containment' phase in incident response?
- Prevent the incident from spreading to additional systems (Correct answer)
- Identify the root cause of the attack
- Restore systems to normal operations
- Document lessons learned
Correct answer: Prevent the incident from spreading to additional systems
Containment stops an active incident from spreading further while preserving evidence and maintaining critical business functions.
Question 3: What does chain of custody mean in digital forensics?
- Documented record tracking who handled evidence and when (Correct answer)
- A blockchain-based authentication protocol
- A sequence of firewall rules
- A method for encrypting forensic disk images
Correct answer: Documented record tracking who handled evidence and when
Chain of custody is the documented, unbroken record of who collected, handled, and transferred digital evidence, essential for legal admissibility.
Question 4: Which tool is commonly used to create a forensic bit-for-bit image of a hard drive?
- dd or FTK Imager (Correct answer)
- Microsoft Word
- nmap
- Wireshark
Correct answer: dd or FTK Imager
Tools like dd (Linux) and FTK Imager create exact bit-for-bit copies of storage media for forensic analysis without altering the original.
Question 5: What is a SIEM system used for in incident response?
- Aggregating and correlating security logs to detect incidents (Correct answer)
- Managing employee HR records
- Encrypting database backups
- Monitoring physical building access
Correct answer: Aggregating and correlating security logs to detect incidents
A SIEM (Security Information and Event Management) system collects logs from across the environment, correlates events, and alerts analysts to potential incidents.
Question 6: What is triage in the context of incident response?
- Prioritizing incidents based on severity and business impact (Correct answer)
- Wiping compromised systems immediately
- Notifying media about a breach
- Patching all systems simultaneously
Correct answer: Prioritizing incidents based on severity and business impact
Triage involves quickly assessing and prioritizing multiple security incidents to allocate response resources to the most critical issues first.
Cyber Security Jobs Incident Response and Digital Forensics 1
What are the standard phases of the NIST incident response lifecycle?