NSE Incident Response & Recovery Procedures 5

Question 1

An IR playbook for phishing incidents instructs analysts to 'quarantine the email across all mailboxes.' In Microsoft 365, which tool is used to search for and purge a specific phishing email organization-wide?

Accepted Answer

Microsoft Purview Content Search with the Purge action

Answer

Microsoft Purview (formerly Compliance Center) Content Search allows IR teams to locate and purge specific emails from all mailboxes across the organization.

Question 2

A threat intelligence report indicates an APT group uses a specific registry key for persistence. During an IR engagement, which Windows command-line tool can quickly query all systems for this registry key's presence?

Accepted Answer

reg query HKLM\...\<key> executed via PsExec or a SIEM remote query

Answer

Using 'reg query' remotely via PsExec or SIEM-orchestrated scripts allows rapid hunting for specific registry keys across the enterprise.

Question 3

An organization discovers that an insider threat exfiltrated 50,000 customer records over six months. Under US federal law, which regulation most likely mandates specific breach notification requirements for this scenario if the data included financial account information?

Accepted Answer

Gramm-Leach-Bliley Act (GLBA) Safeguards Rule

Answer

GLBA governs financial institutions and requires notification when customer financial data is compromised, making it the applicable regulation for financial account information breaches.

Question 4

Which memory forensics technique extracts a list of recently executed processes from a Windows memory dump, including those that have since terminated?

Accepted Answer

Analyzing the process exit records in memory using tools like Volatility's 'pstree' or 'pslist'

Answer

Volatility's process listing plugins can extract both active and recently terminated process structures from memory dumps, revealing attacker tool execution.

Question 5

During recovery, the IR team debates whether to restore from a clean backup taken before the incident or rebuild systems from scratch. Which scenario FAVORS rebuilding from scratch over restoring from backup?

Accepted Answer

When the exact infection date is unknown and all backups may be compromised

Answer

If the infection timeline is unclear, all available backups may contain dormant malware, making clean rebuilds from trusted golden images the safer recovery path.

(NSE) Network Security Expert Practice Test

(NSE) Network Security Expert Practice Test

NSE Incident Response & Recovery Procedures 5