INTRODUCTION – Incident Investigation and Response

TEST YOUR KNOWLEDGE: INCIDENT DETECTION AND VERIFICATION

1. Do detection tools have limitations in their detection capabilities?

2. Why do security analysts refine alert rules? Select two answers.

3. Fill in the blank: _____ involves the investigation and validation of alerts.

4. What are some causes of high alert volumes? Select two answers.

5. What actions do security analysts perform during the Detection and Analysis phase of the NIST Incident Response Lifecycle? Select two answers.

TEST YOUR KNOWLEDGE: RESPONSE AND RECOVERY

1. A security analyst in a security operations center (SOC) receives an alert. The alert ticket describes the detection of the download of a possible malware file on an employee’s computer. Which step of the triage process does this scenario describe?

2. What is triage?

3. Fill in the blank: _____ is the act of limiting and preventing additional damage caused by an incident.

4. Which examples describe actions related to the eradication of an incident? Select two answers.

5. What are the benefits of documentation? Select three answers.

6. What steps are included in the third phase of the NIST Incident Response Lifecycle? Select three answers.

TEST YOUR KNOWLEDGE: POST-INCIDENT ACTIONS

1. Which section of a final report contains a high-level overview of the security incident?

2. What are the goals of a lessons learned meeting? Select two answers.

3. Fill in the blank: In the NIST Incident Response Lifecycle, reviewing an incident to identify areas for improvement during incident handling is known as the _____.

4. An organization has recovered from a ransomware attack that resulted in a significant disruption to their business operations. To review the incident, the security team hosts a lessons learned meeting. The team realizes that they could have restored the affected systems more quickly if they had a backup and recovery plan in place. Which question would have most likely helped the security team come to this conclusion?

5. Which of the following activities do security teams perform during the Post-incident activity phase of the NIST Incident Response Lifecycle? Select two answers.

MODULE 3 CHALLENGE

1. Which step of the NIST Incident Response Lifecycle involves the investigation and validation of alerts?

2. An organization is completing its annual compliance audit. The people performing the audit have access to any relevant information, including records and documents. Which documentation benefit does this scenario outline?

3. An organization is working on implementing a new security tool, and a security analyst has been tasked with developing workflow documentation that outlines the process for using the tool. Which documentation benefit does this scenario outline?

4. A member of the forensics department of an organization receives a computer that requires examination. On which part of the chain of custody form should they sign their name and write the date?

5. Which statement best describes the functionality of automated playbooks?

6. What are the steps of the triage process in the correct order?

7. What are the steps of the third phase of the NIST Incident Response Lifecycle? Select three answers.

8. Which step of the NIST Incident Response Lifecycle involves returning affected systems back to normal operations?

9. Two weeks after an incident involving ransomware, the members of an organization want to review the incident in detail. Which of the following actions should be done during this review? Select all that apply.

10. What does a final report contain? Select three.

11. In the NIST Incident Response Lifecycle, what is the term used to describe the prompt discovery of security events?

12. Which of the following does a semi-automated playbook use? Select two.

13. Fill in the blank: Eradication is the complete _____ of all the incident elements from affected systems.

14. Chain of custody documents establish proof of which of the following? Select two answers.

15. After a security incident involving an exploited vulnerability due to outdated software, a security analyst applies patch updates. Which of the following steps does this task relate to?

16. Fill in the blank: A lessons learned meeting should be held within ____ weeks of an incident.

17. Which documentation provides a comprehensive review of an incident?

18. What are the benefits of documentation during incident response? Select three answers.

19. Fill in the blank: Inconsistencies in the collection and logging of evidence cause a _____ chain of custody.

20. Fill in the blank: Containment is the act of limiting and _____ additional damage caused by an incident.

21. What questions can be asked during a lessons learned meeting? Select three answers.

22. What are examples of how transparent documentation can be useful? Select all that apply.

23. During a lessons learned meeting following an incident, a meeting participant wants to identify actions that the organization can take to prevent similar incidents from occurring in the future. Which section of the final report should they refer to for this information?

CONCLUSION – Incident Investigation and Response