CSX Detect and Respond to Cyber Incidents

Question 1

What is the purpose of a Security Information and Event Management (SIEM) system?

Accepted Answer

Aggregate and analyze security logs

Answer

Perform automated patching

Answer

Block incoming emails

Answer

Encrypt sensitive files

Question 2

What is the first step in an incident response process?

Accepted Answer

Identification

Answer

Recovery

Answer

Containment

Answer

Eradication

Question 3

Which metric best reflects the effectiveness of detecting cyber incidents quickly?

Accepted Answer

Mean Time to Detect

Answer

Mean Time to Recovery

Answer

Patch Time

Answer

Incident Volume

Question 4

Why is containment important during incident response?

Accepted Answer

To prevent further damage and spread

Answer

To delete compromised files immediately

Answer

To slow down the internet

Answer

To reinstall the operating system

Question 5

What is a common method to confirm a detected security incident?

Accepted Answer

Log correlation and validation

Answer

Full disk wipe

Answer

Code refactoring

Answer

Running antivirus scans manually

Question 6

Which action is taken during the recovery phase of incident response?

Accepted Answer

Restore and validate system functionality

Answer

Backup sensitive files

Answer

Monitor threat intelligence feeds

Answer

Block all IP addresses