SY0-601 Operations & Incident Response 3 — Questions and Answers
Question 1: A responder needs to determine what changes were made to files on a compromised Linux server. Which command is MOST useful?
- netstat -an
- find / -newer /etc/passwd (Correct answer)
- ps aux
- df -h
Correct answer: find / -newer /etc/passwd
The `find` command with `-newer` compares file modification timestamps against a reference file to identify recently changed files.
Question 2: What is the PRIMARY purpose of a Security Information and Event Management (SIEM) system?
- Block malware in real time
- Aggregate and correlate log data from multiple sources for threat detection (Correct answer)
- Replace firewalls with AI-driven filtering
- Encrypt data at rest
Correct answer: Aggregate and correlate log data from multiple sources for threat detection
A SIEM collects, normalizes, and correlates log data from across the environment to detect suspicious patterns and generate alerts.
Question 3: Which containment strategy involves placing a compromised system on an isolated network segment while keeping it running for investigation?
- Full shutdown
- Segmentation / network isolation (Correct answer)
- Reimaging
- Patching
Correct answer: Segmentation / network isolation
Segmentation isolates the compromised host from the rest of the network while preserving its running state for forensic analysis.
Question 4: An analyst is reviewing logs and notices an internal host is connecting to a known C2 IP every five minutes. What stage of the kill chain does this BEST represent?
- Reconnaissance
- Delivery
- Command and Control (Correct answer)
- Exploitation
Correct answer: Command and Control
Regular beaconing to a known command-and-control server indicates the attacker is maintaining persistent communication with the compromised host.
Question 5: Which of the following is an example of a technical control used during the recovery phase of incident response?
- Conducting a lessons-learned meeting
- Restoring systems from clean backups (Correct answer)
- Notifying affected customers
- Updating the incident response policy
Correct answer: Restoring systems from clean backups
Restoring from clean backups is a technical recovery action that returns systems to a known-good state after eradication.
Question 6: A forensic investigator receives a hard drive image. Which hashing algorithm should be used to verify the image's integrity matches the original?
- MD5 or SHA-256 (Correct answer)
- AES-256
- RSA-2048
- DES
Correct answer: MD5 or SHA-256
Hashing the original and the image with MD5 or SHA-256 and comparing the values confirms the image is an exact, unaltered copy.
Question 7: Which document defines the roles, responsibilities, and procedures that an organization follows when a security incident occurs?
- Business Continuity Plan
- Incident Response Plan (Correct answer)
- Disaster Recovery Plan
- Change Management Policy
Correct answer: Incident Response Plan
An Incident Response Plan (IRP) outlines who does what and how when a security incident is detected and handled.
SY0-601 Operations & Incident Response 3
A responder needs to determine what changes were made to files on a compromised Linux server.
Which command is MOST useful?