SY0-601 Operations & Incident Response 5 — Questions and Answers
Question 1: Which of the following BEST describes the purpose of an after-action report (AAR) following an incident?
- To prosecute the attacker
- To document findings and recommend improvements to the IR process (Correct answer)
- To restore systems from backup
- To notify regulators of the breach
Correct answer: To document findings and recommend improvements to the IR process
An after-action report captures what happened, what worked, what failed, and provides recommendations to improve future incident response.
Question 2: An analyst needs to identify all active network connections and listening ports on a compromised Windows host. Which command is MOST appropriate?
- ipconfig /all
- netstat -ano (Correct answer)
- tracert 8.8.8.8
- ping localhost
Correct answer: netstat -ano
`netstat -ano` shows all active TCP/UDP connections with associated process IDs, helping identify suspicious listening services or outbound connections.
Question 3: Which of the following attack types is characterized by an adversary maintaining a presence in a network for months without detection?
- Denial of Service
- Advanced Persistent Threat (APT) (Correct answer)
- Script kiddie attack
- Phishing campaign
Correct answer: Advanced Persistent Threat (APT)
APTs are sophisticated, long-term intrusions where attackers remain stealthy to conduct espionage or data exfiltration over extended periods.
Question 4: When responding to a suspected insider threat, which action should a responder take to avoid tipping off the suspect?
- Immediately disable the user's account
- Covertly monitor the user's activity and preserve evidence before taking action (Correct answer)
- Send an all-staff email warning about the threat
- Confront the employee directly
Correct answer: Covertly monitor the user's activity and preserve evidence before taking action
Covert monitoring preserves the investigation's integrity and prevents evidence destruction that would occur if the insider knew they were being watched.
Question 5: Which of the following is the CORRECT order for the NIST SP 800-61 incident response lifecycle?
- Detection → Preparation → Containment → Recovery
- Preparation → Detection & Analysis → Containment, Eradication & Recovery → Post-Incident (Correct answer)
- Containment → Detection → Eradication → Preparation
- Post-Incident → Preparation → Detection → Eradication
Correct answer: Preparation → Detection & Analysis → Containment, Eradication & Recovery → Post-Incident
NIST SP 800-61 defines four phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity.
Question 6: A security analyst is tasked with determining whether a JPEG file contains hidden data. Which technique should be used?
- Fuzzing
- Steganography analysis (Correct answer)
- Port scanning
- Password cracking
Correct answer: Steganography analysis
Steganography analysis tools detect and extract data hidden within image, audio, or other files that appear normal on the surface.
Question 7: Which of the following BEST describes a 'false positive' in the context of security monitoring?
- A real attack that was blocked by a firewall
- An alert triggered by legitimate activity that appears malicious (Correct answer)
- Malware that evades detection entirely
- An unpatched vulnerability on a production server
Correct answer: An alert triggered by legitimate activity that appears malicious
A false positive is when a security tool generates an alert for benign activity, incorrectly classifying it as a threat and wasting analyst time.
SY0-601 Operations & Incident Response 5
Which of the following BEST describes the purpose of an after-action report (AAR) following an incident?