CySA+ Test Incident Response 2 — Questions and Answers
Question 1: During the containment phase of incident response, a security analyst isolates an infected workstation from the network. Which action should be taken NEXT?
- Wipe and reimage the system immediately
- Preserve forensic evidence before any remediation (Correct answer)
- Notify all users about the breach
- Restore from the most recent backup
Correct answer: Preserve forensic evidence before any remediation
Preserving forensic evidence before remediation ensures that volatile data and artifacts needed for investigation are not lost.
Question 2: A CSIRT receives an alert that a user's credentials were used to log in from two geographically distant locations within minutes. What type of indicator is this?
- Indicator of Compromise (IoC)
- Indicator of Attack (IoA)
- False positive
- Behavioral anomaly (Correct answer)
Correct answer: Behavioral anomaly
Simultaneous logins from impossible geographic locations is a behavioral anomaly that signals credential misuse or account compromise.
Question 3: Which document formally authorizes a CSIRT to investigate systems and collect evidence during an incident?
- Incident response plan
- Rules of engagement (Correct answer)
- Service level agreement
- Data retention policy
Correct answer: Rules of engagement
Rules of engagement define the scope, authority, and boundaries for CSIRT activities during an investigation.
Question 4: An analyst discovers ransomware encrypted files on a shared drive. Which containment strategy minimizes business impact while preserving evidence?
- Shut down all servers immediately
- Disable the affected share while keeping systems online (Correct answer)
- Reformat all affected drives
- Allow operations to continue to gather more evidence
Correct answer: Disable the affected share while keeping systems online
Disabling the specific share prevents further encryption while maintaining system availability for evidence collection and business continuity.
Question 5: Which metric measures the time from when an incident is detected to when it is fully resolved?
- Mean Time to Detect (MTTD)
- Mean Time to Respond (MTTR) (Correct answer)
- Recovery Time Objective (RTO)
- Mean Time Between Failures (MTBF)
Correct answer: Mean Time to Respond (MTTR)
Mean Time to Respond (MTTR) measures the total duration from detection through complete resolution of an incident.
Question 6: After recovering from a data breach, the CSIRT conducts a lessons-learned meeting. What is the PRIMARY purpose of this activity?
- Assign blame to responsible parties
- Update insurance documentation
- Improve future incident response processes (Correct answer)
- Notify regulators of the incident
Correct answer: Improve future incident response processes
Lessons-learned meetings are conducted to identify gaps and improve processes, controls, and detection capabilities for future incidents.
Question 7: A threat actor uses living-off-the-land techniques during an attack. Which detection approach is MOST effective against this method?
- Signature-based antivirus scanning
- Behavioral analytics and baseline deviation monitoring (Correct answer)
- File hash blacklisting
- Network port blocking
Correct answer: Behavioral analytics and baseline deviation monitoring
Living-off-the-land attacks use legitimate tools, so behavioral analytics detecting deviations from normal usage patterns is the most effective detection method.
CySA+ Test Incident Response 2
During the containment phase of incident response, a security analyst isolates an infected workstation from the network.
Which action should be taken NEXT?