Threat Detection and Incident Response Flashcards
6 cards from real CSOC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Threat Detection and Incident Response flashcards as text
What are the typical phases of a cybersecurity incident response lifecycle?
Answer: Preparation, Detection and Analysis, Containment, Eradication, Recovery, and Post-Incident Review
The standard incident response lifecycle includes six phases: Preparation (planning and tools), Detection and Analysis (identifying the incident), Containment (limiting spread), Eradication (removing the threat), Recovery (restoring systems), and Post-Incident Review (lessons learned).
What is a Security Information and Event Management (SIEM) system used for in a CSOC?
Answer: Aggregating and correlating security event logs from multiple sources to detect threats and support incident response
A SIEM collects, aggregates, and correlates log data and security events from across an organisation's IT infrastructure, providing security analysts with a unified view to detect anomalies, identify threats, and investigate incidents.
What is an Indicator of Compromise (IoC) in threat detection?
Answer: Evidence found in a network or system that suggests a security breach or malicious activity may have occurred
IoCs are artifacts or pieces of evidence, such as unusual network traffic, specific file hashes, IP addresses, or registry changes, that indicate a system may have been compromised. They are used to detect and investigate potential security incidents.
What is the difference between a security event and a security incident?
Answer: A security event is any observable occurrence; a security incident is an event that adversely affects security or violates a security policy
A security event is any observable occurrence in a system or network that may or may not be malicious. A security incident is a confirmed event that has actually violated security policies, caused harm, or required a formal response.
What is 'containment' in the context of cybersecurity incident response?
Answer: Actions taken to limit the spread and impact of an active security incident while preserving evidence for investigation
Containment stops the incident from spreading further while preserving evidence for forensic analysis. It may involve isolating affected systems from the network, blocking malicious traffic, or disabling compromised accounts.
What is the purpose of a post-incident review (PIR) after a cybersecurity incident?
Answer: To identify what happened, why it happened, and how to improve detection, response, and prevention for the future
A post-incident review is a structured analysis of the incident and the response. Its purpose is to learn from the incident — understanding root causes, evaluating the effectiveness of the response, and identifying improvements to prevent or better handle future incidents.