NSE Incident Response & Recovery Procedures 3

Question 1

A threat actor exfiltrated data over DNS tunneling for three weeks before detection. Which log source would have been MOST valuable for earlier detection?

Accepted Answer

DNS query logs showing unusually long or high-frequency subdomain requests

Answer

DNS tunneling is characterized by abnormally long subdomain strings and high query rates, which are visible in DNS query logs.

Question 2

After restoring systems from backup following a ransomware attack, which step is MOST critical before returning systems to production?

Accepted Answer

Verifying that the initial attack vector has been fully remediated

Answer

Returning systems without fixing the initial attack vector guarantees reinfection, making root cause remediation the top priority before restoration.

Question 3

During incident response, the legal team requests that all IR communications be routed through them. What is the primary reason for this requirement?

Accepted Answer

To protect communications under attorney-client privilege

Answer

Routing IR communications through legal counsel can establish attorney-client privilege, shielding sensitive incident details from disclosure in litigation.

Question 4

An organization experiences a supply chain compromise where a trusted software vendor's update was trojanized. Which IR phase would include revoking trust in all software from that vendor?

Accepted Answer

Eradication

Answer

Eradication involves removing all components of the threat, including revoking trust in compromised software sources to prevent reinfection.

Question 5

A security team uses the PICERL model for incident response. What does the 'L' represent, and why is it considered one of the most important phases?

Accepted Answer

Lessons Learned — because it drives continuous improvement of the IR program

Answer

Lessons Learned captures what went wrong and what worked, enabling the organization to improve detection, response, and prevention capabilities.

(NSE) Network Security Expert Practice Test

(NSE) Network Security Expert Practice Test

NSE Incident Response & Recovery Procedures 3