NSE Incident Response & Recovery Procedures 3 — Questions and Answers
Question 1: A threat actor exfiltrated data over DNS tunneling for three weeks before detection. Which log source would have been MOST valuable for earlier detection?
- Windows Security Event logs on domain controllers
- DNS query logs showing unusually long or high-frequency subdomain requests (Correct answer)
- NetFlow data showing large TCP transfers to external IPs
- Proxy logs filtering known malicious URLs
Correct answer: DNS query logs showing unusually long or high-frequency subdomain requests
DNS tunneling is characterized by abnormally long subdomain strings and high query rates, which are visible in DNS query logs.
Question 2: After restoring systems from backup following a ransomware attack, which step is MOST critical before returning systems to production?
- Re-enabling all user accounts that were disabled during containment
- Verifying that the initial attack vector has been fully remediated (Correct answer)
- Notifying customers that systems are back online
- Running a full vulnerability scan to identify any new CVEs
Correct answer: Verifying that the initial attack vector has been fully remediated
Returning systems without fixing the initial attack vector guarantees reinfection, making root cause remediation the top priority before restoration.
Question 3: During incident response, the legal team requests that all IR communications be routed through them. What is the primary reason for this requirement?
- To ensure technical accuracy of all communications
- To protect communications under attorney-client privilege (Correct answer)
- To comply with mandatory breach notification timelines
- To coordinate with cyber insurance underwriters
Correct answer: To protect communications under attorney-client privilege
Routing IR communications through legal counsel can establish attorney-client privilege, shielding sensitive incident details from disclosure in litigation.
Question 4: An organization experiences a supply chain compromise where a trusted software vendor's update was trojanized. Which IR phase would include revoking trust in all software from that vendor?
- Preparation
- Detection and Analysis
- Eradication (Correct answer)
- Post-Incident Activity
Correct answer: Eradication
Eradication involves removing all components of the threat, including revoking trust in compromised software sources to prevent reinfection.
Question 5: A security team uses the PICERL model for incident response. What does the 'L' represent, and why is it considered one of the most important phases?
- Lockdown — because it prevents further compromise during active incidents
- Lessons Learned — because it drives continuous improvement of the IR program (Correct answer)
- Logging — because accurate records are required for regulatory compliance
- Lateral movement analysis — because attackers frequently move across networks
Correct answer: Lessons Learned — because it drives continuous improvement of the IR program
Lessons Learned captures what went wrong and what worked, enabling the organization to improve detection, response, and prevention capabilities.
Question 6: A company's RTO for its core ERP system is 4 hours. A ransomware event occurs at 9:00 AM. What is the latest acceptable time for the ERP system to be operational?
- 11:00 AM
- 1:00 PM (Correct answer)
- 5:00 PM
- 9:00 AM the next day
Correct answer: 1:00 PM
RTO of 4 hours from the 9:00 AM incident time means the system must be restored by 1:00 PM at the latest.
Question 7: Which artifact is MOST useful for establishing the timeline of attacker activity on a compromised Windows endpoint?
- The system's hosts file
- Windows Event Log entries combined with $MFT (Master File Table) timestamps (Correct answer)
- The browser's saved passwords
- Active Directory group membership records
Correct answer: Windows Event Log entries combined with $MFT (Master File Table) timestamps
Combining Windows Event Logs with NTFS MFT timestamps provides a detailed chronological record of file system changes and security events tied to attacker actions.
NSE Incident Response & Recovery Procedures 3
A threat actor exfiltrated data over DNS tunneling for three weeks before detection.
Which log source would have been MOST valuable for earlier detection?