Cyber Security Jobs Incident Response and Digital Forensics

Question 1

What are the standard phases of the NIST incident response lifecycle?

Accepted Answer

Preparation, Detection & Analysis, Containment/Eradication/Recovery, Post-Incident Activity

Answer

NIST SP 800-61 defines four phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity.

Question 2

What is the primary goal of the 'containment' phase in incident response?

Accepted Answer

Prevent the incident from spreading to additional systems

Answer

Containment stops an active incident from spreading further while preserving evidence and maintaining critical business functions.

Question 3

What does chain of custody mean in digital forensics?

Accepted Answer

Documented record tracking who handled evidence and when

Answer

Chain of custody is the documented, unbroken record of who collected, handled, and transferred digital evidence, essential for legal admissibility.

Question 4

Which tool is commonly used to create a forensic bit-for-bit image of a hard drive?

Accepted Answer

dd or FTK Imager

Answer

Tools like dd (Linux) and FTK Imager create exact bit-for-bit copies of storage media for forensic analysis without altering the original.

Question 5

What is a SIEM system used for in incident response?

Accepted Answer

Aggregating and correlating security logs to detect incidents

Answer

A SIEM (Security Information and Event Management) system collects logs from across the environment, correlates events, and alerts analysts to potential incidents.

Cyber Security Jobs Practice Test

Cyber Security Jobs Practice Test

Cyber Security Jobs Incident Response and Digital Forensics