Cyber Security Incident Response

Question 1

What is the first step in the NIST incident response lifecycle?

Accepted Answer

Preparation

Answer

Preparation is the first phase in NIST SP 800-61's incident response lifecycle, establishing policies, teams, and tools.

Question 2

What does containment in incident response aim to achieve?

Accepted Answer

Limit the spread and damage of the incident

Answer

Containment stops the incident from spreading to additional systems while the organization investigates and plans recovery.

Question 3

What is the primary goal of the eradication phase in incident response?

Accepted Answer

Remove the threat from all affected systems

Answer

Eradication removes malware, closes vulnerabilities, and eliminates all traces of the attacker from affected systems.

Question 4

What is a chain of custody in digital forensics?

Accepted Answer

Documentation tracking evidence handling from collection to court presentation

Answer

Chain of custody documents who handled digital evidence, when, and how, preserving its integrity for legal proceedings.

Question 5

What type of malware encrypts victim files and demands payment for the decryption key?

Accepted Answer

Ransomware

Answer

Ransomware encrypts files on infected systems and demands payment (usually cryptocurrency) for the decryption key.

Cyber Security Practice Test