SY0-601 Operations & Incident Response 2 — Questions and Answers
Question 1: During a forensic investigation, an analyst needs to preserve evidence from a compromised system. Which action should be performed FIRST?
- Run antivirus to clean the system
- Capture a memory dump before powering off (Correct answer)
- Reboot the system to apply patches
- Delete suspicious processes immediately
Correct answer: Capture a memory dump before powering off
Memory is volatile and will be lost on power-off, so capturing a RAM dump first preserves critical evidence like running processes and encryption keys.
Question 2: Which NIST incident response phase focuses on limiting the damage after a security incident is confirmed?
- Preparation
- Detection and Analysis
- Containment, Eradication, and Recovery (Correct answer)
- Post-Incident Activity
Correct answer: Containment, Eradication, and Recovery
The Containment, Eradication, and Recovery phase is where responders limit damage, remove threats, and restore systems.
Question 3: A security analyst observes repeated failed SSH login attempts from a single IP address. What type of attack is most likely occurring?
- Phishing
- Brute force (Correct answer)
- SQL injection
- Man-in-the-middle
Correct answer: Brute force
Repeated failed login attempts from one source are characteristic of a brute force attack trying to guess credentials.
Question 4: Which tool is BEST suited for capturing and analyzing network packets during an incident?
- Nessus
- Wireshark (Correct answer)
- Metasploit
- Nmap
Correct answer: Wireshark
Wireshark is a packet capture and protocol analyzer used to inspect network traffic in real time or from saved captures.
Question 5: What does the term 'chain of custody' mean in digital forensics?
- A blockchain-based evidence storage system
- Documentation tracking who handled evidence and when (Correct answer)
- Encrypting evidence before storage
- The order in which systems are patched after an incident
Correct answer: Documentation tracking who handled evidence and when
Chain of custody is a documented record showing who collected, handled, transferred, and analyzed evidence to ensure its integrity in legal proceedings.
Question 6: An organization wants to ensure that after a major incident, lessons are documented to prevent recurrence. Which phase covers this?
- Preparation
- Containment
- Eradication
- Post-Incident Activity (Lessons Learned) (Correct answer)
Correct answer: Post-Incident Activity (Lessons Learned)
Post-Incident Activity includes the lessons-learned meeting where teams review what happened and improve processes to prevent recurrence.
Question 7: Which of the following BEST describes a tabletop exercise?
- A live simulation where systems are actually attacked
- A discussion-based walkthrough of an incident scenario (Correct answer)
- Penetration testing against production systems
- Automated red team scanning
Correct answer: A discussion-based walkthrough of an incident scenario
A tabletop exercise is a discussion-based session where stakeholders walk through a hypothetical incident to evaluate their response plan without actual system disruption.
SY0-601 Operations & Incident Response 2
During a forensic investigation, an analyst needs to preserve evidence from a compromised system.
Which action should be performed FIRST?