SY0-601 Operations & Incident Response

Question 1

What is the first step in incident response?

Accepted Answer

Identification

Answer

Recovery

Answer

Containment

Answer

Eradication

Question 2

What is containment in incident response?

Accepted Answer

Limit damage

Answer

Erase logs

Answer

Change passwords

Answer

Reboot systems

Question 3

Why is documentation important in IR?

Accepted Answer

Track actions and improve

Answer

Delete evidence

Answer

Share passwords

Answer

Avoid delays

Question 4

What is a security information and event management (SIEM) system?

Accepted Answer

Analyze security alerts

Answer

Generate backups

Answer

Encrypt data

Answer

Disable firewalls

Question 5

What is log analysis?

Accepted Answer

Review logs

Answer

Delete logs

Answer

Ignore alerts

Answer

Change settings

Question 6

What is threat hunting?

Accepted Answer

Proactive threat search

Answer

Fix printers

Answer

Send emails

Answer

Backup files

Question 7

Why conduct root cause analysis?

Accepted Answer

Find source of issue

Answer

Blame staff

Answer

Update software

Answer

Change password

Question 8

What is the recovery phase?

Accepted Answer

Restore systems

Answer

Shut down servers

Answer

Ignore alerts

Answer

Isolate users

Question 9

Why test an incident response plan?

Accepted Answer

Ensure effectiveness

Answer

Skip response

Answer

Avoid panic

Answer

Reduce cost