Threat Detection and Incident Response Flashcards
6 cards from real CSOC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Threat Detection and Incident Response flashcards as text
What is 'lateral movement' in the context of a cyber attack?
Answer: The technique used by an attacker to progressively move through a compromised network to reach high-value targets
Lateral movement describes how an attacker, after gaining initial access, navigates through a network to reach additional systems, escalate privileges, and access valuable assets. It is a key phase in many advanced persistent threat (APT) campaigns.
What is the role of a 'playbook' in cybersecurity incident response?
Answer: A predefined, documented set of steps for responding to specific types of security incidents consistently and efficiently
An incident response playbook provides a standardised, step-by-step guide for responding to a specific type of incident such as ransomware, phishing, or DDoS. Playbooks reduce response time and ensure consistent handling of incidents.
What does 'threat hunting' involve in a CSOC environment?
Answer: Proactively searching through networks and systems for hidden threats that have evaded automated detection systems
Threat hunting is a proactive, human-driven process where analysts search for threats that may have bypassed automated detection tools. It involves hypothesis-based investigations, analysis of behavioural anomalies, and deep examination of system and network data.
What is 'alert fatigue' in a CSOC and why is it a security risk?
Answer: When analysts are overwhelmed by excessive security alerts, leading to desensitisation and missed real threats
Alert fatigue occurs when SOC analysts receive so many alerts that they begin to dismiss or overlook them, increasing the risk that genuine threats are missed. Reducing false positives and improving alert prioritisation are key strategies to address it.
During a cybersecurity incident, why is it important to maintain a detailed incident timeline?
Answer: A timeline establishes the sequence of events, supports forensic analysis, aids in containment decisions, and provides evidence for legal proceedings
An incident timeline documents the chronological sequence of events, which is essential for understanding the attack's progression, making informed containment and eradication decisions, conducting forensic analysis, and supporting potential legal or regulatory proceedings.
What is the significance of 'chain of custody' in cybersecurity incident response?
Answer: It refers to the documented, unbroken record of how digital evidence has been handled, ensuring its integrity for potential legal proceedings
Chain of custody ensures that digital evidence collected during an incident investigation is properly documented, preserved, and handled so that its integrity is maintained. This is essential if the evidence is to be used in legal or regulatory proceedings.