NSE Incident Response & Recovery Procedures 2 — Questions and Answers
Question 1: During the containment phase of an incident, a security analyst discovers that malware has spread to 20 endpoints. Which containment strategy minimizes business disruption while limiting further spread?
- Immediately shut down all 20 affected endpoints
- Isolate affected endpoints on a separate VLAN while keeping them online for forensic purposes (Correct answer)
- Reimage all affected endpoints before conducting any investigation
- Block all outbound traffic at the perimeter firewall
Correct answer: Isolate affected endpoints on a separate VLAN while keeping them online for forensic purposes
Network isolation via VLAN preserves forensic evidence and allows continued investigation while preventing lateral movement without complete service disruption.
Question 2: A post-incident review reveals that the mean time to detect (MTTD) a breach was 120 days. Which improvement would most directly reduce MTTD?
- Increasing the number of incident responders on staff
- Deploying user and entity behavior analytics (UEBA) with anomaly detection (Correct answer)
- Implementing stronger password policies across the organization
- Expanding the backup retention period to 180 days
Correct answer: Deploying user and entity behavior analytics (UEBA) with anomaly detection
UEBA with anomaly detection identifies unusual behavior patterns automatically, enabling much faster detection of threats that evade signature-based tools.
Question 3: During eradication, investigators confirm a threat actor maintained persistence via a scheduled task. Which action is MOST important before removing the persistence mechanism?
- Patch the vulnerability that allowed initial access
- Document and preserve forensic artifacts related to the scheduled task (Correct answer)
- Notify affected users to change their passwords
- Update endpoint detection and response (EDR) signatures
Correct answer: Document and preserve forensic artifacts related to the scheduled task
Preserving forensic artifacts before removal ensures evidence integrity for legal proceedings and root cause analysis.
Question 4: An IRP (Incident Response Plan) defines a 'critical' incident as one affecting more than 30% of production systems. During an active ransomware event affecting 35% of systems, the IR team lead is unavailable. What should happen next?
- Wait for the IR team lead to become available before escalating
- The next person in the defined escalation chain assumes command (Correct answer)
- The most senior technical person present makes all decisions independently
- Downgrade the incident classification to avoid escalation
Correct answer: The next person in the defined escalation chain assumes command
A well-defined IRP includes an escalation chain so incident command transfers seamlessly when primary responders are unavailable.
Question 5: A forensic investigator collects volatile memory from a compromised Windows server. Which data would ONLY be available from the memory dump and NOT from disk-based artifacts?
- Windows Event Logs from the past 30 days
- Encryption keys held in RAM by active processes (Correct answer)
- Prefetch files showing recently executed programs
- Registry hives stored on the system volume
Correct answer: Encryption keys held in RAM by active processes
Encryption keys exist only in RAM while processes are running and are lost when the system is powered off, making memory forensics essential.
Question 6: Which recovery metric describes the maximum tolerable amount of data loss measured in time, and is a key input when designing backup strategies?
- Mean Time to Recovery (MTTR)
- Recovery Point Objective (RPO) (Correct answer)
- Recovery Time Objective (RTO)
- Mean Time Between Failures (MTBF)
Correct answer: Recovery Point Objective (RPO)
RPO defines the maximum acceptable data loss window, directly determining backup frequency requirements.
Question 7: During a tabletop exercise simulating a data breach, participants realize the IR plan does not specify who is authorized to communicate with law enforcement. What is the PRIMARY risk of this gap?
- Forensic evidence may be collected incorrectly
- Unauthorized disclosures could compromise the investigation or violate legal obligations (Correct answer)
- The recovery timeline will exceed the RTO
- Employees may not be notified promptly
Correct answer: Unauthorized disclosures could compromise the investigation or violate legal obligations
Unauthorized or improper law enforcement communication can prejudice investigations, create legal liability, or result in premature disclosure of sensitive breach details.
NSE Incident Response & Recovery Procedures 2
During the containment phase of an incident, a security analyst discovers that malware has spread to 20 endpoints.
Which containment strategy minimizes business disruption while limiting further spread?