NSE Incident Response & Recovery Procedures 4 — Questions and Answers
Question 1: During a live response, an analyst runs 'netstat -ano' on a compromised host and finds an established connection to an external IP on port 443. What is the FIRST action the analyst should take?
- Immediately terminate the process holding the connection
- Document the connection details including PID, remote IP, and timestamp before taking any action (Correct answer)
- Block the external IP at the firewall
- Reboot the system to terminate all active connections
Correct answer: Document the connection details including PID, remote IP, and timestamp before taking any action
Documentation preserves the volatile state of the connection for forensic analysis before any remediation actions alter the evidence.
Question 2: An IR team determines that an attacker used stolen credentials to access an Azure tenant. Which Azure-native tool provides the audit log of all authentication events and administrative actions?
- Azure Security Center recommendations feed
- Azure Active Directory (Entra ID) Audit Logs and Sign-in Logs (Correct answer)
- Azure Cost Management billing alerts
- Azure Advisor performance recommendations
Correct answer: Azure Active Directory (Entra ID) Audit Logs and Sign-in Logs
Azure AD (Entra ID) Audit Logs and Sign-in Logs record all authentication attempts, MFA events, and administrative changes within the tenant.
Question 3: A financial organization is required to notify regulators within 36 hours of discovering a breach under a specific regulation. The breach was discovered on Monday at 8:00 PM. What is the notification deadline?
- Tuesday at 8:00 AM
- Wednesday at 8:00 AM (Correct answer)
- Wednesday at 8:00 PM
- Thursday at 8:00 PM
Correct answer: Wednesday at 8:00 AM
36 hours after Monday 8:00 PM is Wednesday 8:00 AM, which is the latest permissible notification time under the 36-hour rule.
Question 4: Which technique do adversaries commonly use to achieve persistence on Linux systems that IR analysts should check during the eradication phase?
- Modifying the Windows Registry Run keys
- Adding unauthorized SSH keys to ~/.ssh/authorized_keys or creating rogue cron jobs (Correct answer)
- Disabling Windows Defender real-time protection
- Changing local Group Policy Object (GPO) settings
Correct answer: Adding unauthorized SSH keys to ~/.ssh/authorized_keys or creating rogue cron jobs
Unauthorized SSH authorized_keys entries and malicious cron jobs are the most common persistence mechanisms on Linux systems.
Question 5: A cyber insurance policy requires that the insured organization notify the insurer within 72 hours of discovering a material incident. Failure to do so may result in what consequence?
- Automatic upgrade to a higher coverage tier
- Denial of coverage or reduced claim payout for the incident (Correct answer)
- Mandatory third-party forensic investigation at the insurer's expense
- Automatic regulatory breach notification filing by the insurer
Correct answer: Denial of coverage or reduced claim payout for the incident
Failure to comply with timely notification clauses in cyber insurance policies is a common grounds for claim denial or coverage reduction.
Question 6: After a major incident, an organization wants to test their updated IR plan without operational disruption. Which exercise type simulates an incident using scenario injects but does not involve actual systems?
- Red team exercise
- Tabletop exercise (Correct answer)
- Full-scale simulation
- Penetration test
Correct answer: Tabletop exercise
Tabletop exercises walk key stakeholders through a simulated scenario verbally, testing decision-making and plan effectiveness without touching live systems.
Question 7: During triage, an analyst classifies an alert as a 'false positive.' What does this classification mean, and what is the appropriate next action?
- A real attack occurred but was blocked; escalate to containment
- Benign activity was flagged as malicious; tune detection rules to reduce noise (Correct answer)
- A real attack was missed; update signatures immediately
- Malicious activity was correctly identified; begin eradication
Correct answer: Benign activity was flagged as malicious; tune detection rules to reduce noise
A false positive is a benign event incorrectly flagged as malicious; the proper response is to document it and tune detection logic to prevent recurrence.
NSE Incident Response & Recovery Procedures 4
During a live response, an analyst runs 'netstat -ano' on a compromised host and finds an established connection to an external IP on port 443.
What is the FIRST action the analyst should take?