ISP Security Investigations & Incident Response Flashcards

What does 'triage' mean in the context of security incident management?

Answer: Quickly assessing and prioritizing incidents based on severity and potential impact to allocate response resources

Triage allows security teams to focus limited resources on the most critical incidents first by rapidly assessing severity.

A security manager discovers that a former employee's access credentials were used to log in two weeks after termination. This indicates a failure in:

Answer: Access termination and offboarding procedures

Access that survives beyond an employee's departure indicates the offboarding process failed to revoke credentials in a timely manner.

Which type of malware is specifically designed to remain hidden while granting an attacker persistent, privileged access to a system?

Answer: Rootkit

Rootkits are designed to hide their presence and provide an attacker with sustained administrative access to a compromised system.

What is the purpose of a security incident log?

Answer: To create an auditable record of all events, actions taken, and decision points during an investigation

Incident logs provide the documentary trail needed for post-incident review, legal proceedings, insurance claims, and regulatory reporting.

In a cleared facility, a 'security violation' is BEST defined as:

Answer: Any act or omission that is contrary to established security regulations, regardless of intent

Security violations include both deliberate and negligent breaches of security requirements and must be reported regardless of intent.

Which evidence type has the HIGHEST evidentiary value in a digital security investigation?

Answer: Forensically verified, bit-for-bit image of the original storage media with verified hash values

A forensic image with cryptographic hash verification proves the copy is identical to the original, giving it strong evidentiary weight.