SY0-601 Operations & Incident Response 3

Question 1

A responder needs to determine what changes were made to files on a compromised Linux server. Which command is MOST useful?

Accepted Answer

find / -newer /etc/passwd

Answer

The `find` command with `-newer` compares file modification timestamps against a reference file to identify recently changed files.

Question 2

What is the PRIMARY purpose of a Security Information and Event Management (SIEM) system?

Accepted Answer

Aggregate and correlate log data from multiple sources for threat detection

Answer

A SIEM collects, normalizes, and correlates log data from across the environment to detect suspicious patterns and generate alerts.

Question 3

Which containment strategy involves placing a compromised system on an isolated network segment while keeping it running for investigation?

Accepted Answer

Segmentation / network isolation

Answer

Segmentation isolates the compromised host from the rest of the network while preserving its running state for forensic analysis.

Question 4

An analyst is reviewing logs and notices an internal host is connecting to a known C2 IP every five minutes. What stage of the kill chain does this BEST represent?

Accepted Answer

Command and Control

Answer

Regular beaconing to a known command-and-control server indicates the attacker is maintaining persistent communication with the compromised host.

Question 5

Which of the following is an example of a technical control used during the recovery phase of incident response?

Accepted Answer

Restoring systems from clean backups

Answer

Restoring from clean backups is a technical recovery action that returns systems to a known-good state after eradication.

(SY0-601) CompTIA Security+ IT Certification Practice Test

(SY0-601) CompTIA Security+ IT Certification Practice Test

SY0-601 Operations & Incident Response 3