SY0-601 Operations & Incident Response 5

Question 1

Which of the following BEST describes the purpose of an after-action report (AAR) following an incident?

Accepted Answer

To document findings and recommend improvements to the IR process

Answer

An after-action report captures what happened, what worked, what failed, and provides recommendations to improve future incident response.

Question 2

An analyst needs to identify all active network connections and listening ports on a compromised Windows host. Which command is MOST appropriate?

Accepted Answer

netstat -ano

Answer

`netstat -ano` shows all active TCP/UDP connections with associated process IDs, helping identify suspicious listening services or outbound connections.

Question 3

Which of the following attack types is characterized by an adversary maintaining a presence in a network for months without detection?

Accepted Answer

Advanced Persistent Threat (APT)

Answer

APTs are sophisticated, long-term intrusions where attackers remain stealthy to conduct espionage or data exfiltration over extended periods.

Question 4

When responding to a suspected insider threat, which action should a responder take to avoid tipping off the suspect?

Accepted Answer

Covertly monitor the user's activity and preserve evidence before taking action

Answer

Covert monitoring preserves the investigation's integrity and prevents evidence destruction that would occur if the insider knew they were being watched.

Question 5

Which of the following is the CORRECT order for the NIST SP 800-61 incident response lifecycle?

Accepted Answer

Preparation → Detection & Analysis → Containment, Eradication & Recovery → Post-Incident

Answer

NIST SP 800-61 defines four phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity.

(SY0-601) CompTIA Security+ IT Certification Practice Test

(SY0-601) CompTIA Security+ IT Certification Practice Test

SY0-601 Operations & Incident Response 5