NSE Incident Response & Recovery Procedures 2

Question 1

During the containment phase of an incident, a security analyst discovers that malware has spread to 20 endpoints. Which containment strategy minimizes business disruption while limiting further spread?

Accepted Answer

Isolate affected endpoints on a separate VLAN while keeping them online for forensic purposes

Answer

Network isolation via VLAN preserves forensic evidence and allows continued investigation while preventing lateral movement without complete service disruption.

Question 2

A post-incident review reveals that the mean time to detect (MTTD) a breach was 120 days. Which improvement would most directly reduce MTTD?

Accepted Answer

Deploying user and entity behavior analytics (UEBA) with anomaly detection

Answer

UEBA with anomaly detection identifies unusual behavior patterns automatically, enabling much faster detection of threats that evade signature-based tools.

Question 3

During eradication, investigators confirm a threat actor maintained persistence via a scheduled task. Which action is MOST important before removing the persistence mechanism?

Accepted Answer

Document and preserve forensic artifacts related to the scheduled task

Answer

Preserving forensic artifacts before removal ensures evidence integrity for legal proceedings and root cause analysis.

Question 4

An IRP (Incident Response Plan) defines a 'critical' incident as one affecting more than 30% of production systems. During an active ransomware event affecting 35% of systems, the IR team lead is unavailable. What should happen next?

Accepted Answer

The next person in the defined escalation chain assumes command

Answer

A well-defined IRP includes an escalation chain so incident command transfers seamlessly when primary responders are unavailable.

Question 5

A forensic investigator collects volatile memory from a compromised Windows server. Which data would ONLY be available from the memory dump and NOT from disk-based artifacts?

Accepted Answer

Encryption keys held in RAM by active processes

Answer

Encryption keys exist only in RAM while processes are running and are lost when the system is powered off, making memory forensics essential.

(NSE) Network Security Expert Practice Test

(NSE) Network Security Expert Practice Test

NSE Incident Response & Recovery Procedures 2