NSE Incident Response & Recovery Procedures 4

Question 1

During a live response, an analyst runs 'netstat -ano' on a compromised host and finds an established connection to an external IP on port 443. What is the FIRST action the analyst should take?

Accepted Answer

Document the connection details including PID, remote IP, and timestamp before taking any action

Answer

Documentation preserves the volatile state of the connection for forensic analysis before any remediation actions alter the evidence.

Question 2

An IR team determines that an attacker used stolen credentials to access an Azure tenant. Which Azure-native tool provides the audit log of all authentication events and administrative actions?

Accepted Answer

Azure Active Directory (Entra ID) Audit Logs and Sign-in Logs

Answer

Azure AD (Entra ID) Audit Logs and Sign-in Logs record all authentication attempts, MFA events, and administrative changes within the tenant.

Question 3

A financial organization is required to notify regulators within 36 hours of discovering a breach under a specific regulation. The breach was discovered on Monday at 8:00 PM. What is the notification deadline?

Accepted Answer

Wednesday at 8:00 AM

Answer

36 hours after Monday 8:00 PM is Wednesday 8:00 AM, which is the latest permissible notification time under the 36-hour rule.

Question 4

Which technique do adversaries commonly use to achieve persistence on Linux systems that IR analysts should check during the eradication phase?

Accepted Answer

Adding unauthorized SSH keys to ~/.ssh/authorized_keys or creating rogue cron jobs

Answer

Unauthorized SSH authorized_keys entries and malicious cron jobs are the most common persistence mechanisms on Linux systems.

Question 5

A cyber insurance policy requires that the insured organization notify the insurer within 72 hours of discovering a material incident. Failure to do so may result in what consequence?

Accepted Answer

Denial of coverage or reduced claim payout for the incident

Answer

Failure to comply with timely notification clauses in cyber insurance policies is a common grounds for claim denial or coverage reduction.

(NSE) Network Security Expert Practice Test

(NSE) Network Security Expert Practice Test

NSE Incident Response & Recovery Procedures 4