NSE Incident Response & Recovery Procedures 5 — Questions and Answers
Question 1: An IR playbook for phishing incidents instructs analysts to 'quarantine the email across all mailboxes.' In Microsoft 365, which tool is used to search for and purge a specific phishing email organization-wide?
- Microsoft Intune Device Compliance Policies
- Microsoft Purview Content Search with the Purge action (Correct answer)
- Azure AD Conditional Access Policies
- Microsoft Defender for Endpoint Live Response
Correct answer: Microsoft Purview Content Search with the Purge action
Microsoft Purview (formerly Compliance Center) Content Search allows IR teams to locate and purge specific emails from all mailboxes across the organization.
Question 2: A threat intelligence report indicates an APT group uses a specific registry key for persistence. During an IR engagement, which Windows command-line tool can quickly query all systems for this registry key's presence?
- ipconfig /all
- reg query HKLM\...\<key> executed via PsExec or a SIEM remote query (Correct answer)
- netstat -b
- sfc /scannow
Correct answer: reg query HKLM\...\<key> executed via PsExec or a SIEM remote query
Using 'reg query' remotely via PsExec or SIEM-orchestrated scripts allows rapid hunting for specific registry keys across the enterprise.
Question 3: An organization discovers that an insider threat exfiltrated 50,000 customer records over six months. Under US federal law, which regulation most likely mandates specific breach notification requirements for this scenario if the data included financial account information?
- HIPAA Security Rule
- Gramm-Leach-Bliley Act (GLBA) Safeguards Rule (Correct answer)
- FERPA
- COPPA
Correct answer: Gramm-Leach-Bliley Act (GLBA) Safeguards Rule
GLBA governs financial institutions and requires notification when customer financial data is compromised, making it the applicable regulation for financial account information breaches.
Question 4: Which memory forensics technique extracts a list of recently executed processes from a Windows memory dump, including those that have since terminated?
- Parsing the Windows Registry SOFTWARE hive
- Analyzing the process exit records in memory using tools like Volatility's 'pstree' or 'pslist' (Correct answer)
- Reviewing the Windows Recycle Bin metadata
- Examining prefetch files from the C:\Windows\Prefetch directory
Correct answer: Analyzing the process exit records in memory using tools like Volatility's 'pstree' or 'pslist'
Volatility's process listing plugins can extract both active and recently terminated process structures from memory dumps, revealing attacker tool execution.
Question 5: During recovery, the IR team debates whether to restore from a clean backup taken before the incident or rebuild systems from scratch. Which scenario FAVORS rebuilding from scratch over restoring from backup?
- When the backup was taken less than 24 hours before the incident
- When the exact infection date is unknown and all backups may be compromised (Correct answer)
- When the RTO is less than 2 hours
- When the affected systems run non-critical internal tools
Correct answer: When the exact infection date is unknown and all backups may be compromised
If the infection timeline is unclear, all available backups may contain dormant malware, making clean rebuilds from trusted golden images the safer recovery path.
Question 6: A security operations center (SOC) receives 10,000 alerts per day. To improve IR efficiency, which capability should the team prioritize implementing?
- Hiring additional tier-1 analysts to manually review every alert
- Security Orchestration, Automation, and Response (SOAR) to automate triage and enrichment of common alert types (Correct answer)
- Disabling lower-fidelity detection rules to reduce volume
- Switching to a different SIEM vendor with a simpler interface
Correct answer: Security Orchestration, Automation, and Response (SOAR) to automate triage and enrichment of common alert types
SOAR platforms automate repetitive triage tasks and alert enrichment, dramatically reducing the manual workload and accelerating response to high-volume alert environments.
Question 7: After an IR engagement, a company's legal counsel advises that the incident report should be labeled 'Attorney Work Product.' What is the primary purpose of this designation?
- To ensure the report is archived in the correct compliance system
- To shield the report from discovery in civil litigation by asserting work product protection (Correct answer)
- To restrict access to executive leadership only
- To comply with SEC disclosure requirements for public companies
Correct answer: To shield the report from discovery in civil litigation by asserting work product protection
The attorney work product doctrine protects documents prepared in anticipation of litigation from being compelled in discovery, limiting an adversary's access to the full incident report.
NSE Incident Response & Recovery Procedures 5
An IR playbook for phishing incidents instructs analysts to 'quarantine the email across all mailboxes.' In Microsoft 365, which tool is used to search for and purge a specific phishing email organization-wide?