Incident Response

A SIEM alert indicates multiple failed logins followed by a successful login from a new IP in Splunk Enterprise Security. As a first responder, which dashboard should you navigate to in order to verify the MITRE ATT&CK mapping of this behavior?

While using ServiceNow Security Incident Response (SIR), you need to escalate a ticket. What is the standard process to ensure the security manager receives notification?

During incident triage, you realize an alert is a False Positive. What is the most appropriate action to take within the SIEM ticketing system?

You are triaging an alert in CrowdStrike Falcon. An endpoint shows a 'Suspicious File' detection. To verify the process tree and identify the parent process, which view do you use?

You are managing a containment procedure for an external C2 callback. Which firewall rule configuration is most effective for immediate containment?

A suspicious PowerShell script is found on an endpoint. Which tool would you use to perform volatile memory analysis to identify if the script injected malicious code?

During a suspected malware incident, a SOC analyst needs to isolate an infected workstation using Microsoft Defender for Endpoint. Which specific action should the analyst select within the Device inventory dashboard?

You are using an EDR to hunt for persistent scheduled tasks. Which artifact should you analyze to see tasks created within the last 24 hours?

What is the primary purpose of a 'War Room' during a major incident?

You need to export a PCAP for a suspicious network flow. Using Wireshark, which filter would you use to isolate traffic from a specific suspicious source IP 192.168.1.50?

When dealing with a ransomware incident, why should you prioritize disconnecting the host from the network over immediate rebooting?

During an investigation, you need to perform a live acquisition of a suspect's system memory using FTK Imager. What is the correct order of operations to maintain integrity?

Which document should you reference first to determine the communication path during a high-severity security incident?

In the NIST Incident Response lifecycle, which phase involves the identification of the incident type and scope?

An analyst is reviewing logs in Splunk to investigate a potential exfiltration event. Which field should the analyst focus on to identify the volume of data sent to an external IP?

You are remediating a compromised web server. After identifying the web shell, what is the next step to prevent further access?

In the context of the MITRE ATT&CK framework, what is the primary goal of the 'Command and Control' tactic?

You are performing triage for an alert involving unauthorized access to an S3 bucket. Which service would you consult to review the API calls made to that bucket?

While analyzing an incident involving a malicious domain, you need to determine when the domain was registered. Which database should you query?

During a suspected lateral movement incident, you observe successful SMB sessions between two workstations. Which tool in Windows can be used to view these active sessions?

You are analyzing an alert for a suspicious PowerShell command. Which logging setting must be enabled on Windows endpoints to capture the full command-line arguments?

What is the primary function of an IOC (Indicator of Compromise) in an incident?

Which document is essential for recording every action taken during an incident for legal and audit purposes?

When an analyst suspects that a malicious user is using a VPN to hide their source IP, which technique is most helpful for attribution?

You are investigating a data exfiltration incident. Which protocol's logs would most likely show large volumes of data being moved to a cloud storage provider?

What is the primary goal of the 'Eradication' phase in incident response?

What is the main objective of the 'Post-Incident Activity' phase?

You are auditing user access logs for a potential privilege escalation. What indicates that a user has successfully used 'runas' to switch context?

During a phishing investigation, you receive a suspicious link. Which safety measure should you use to analyze the link?

You need to verify if an executable is malicious. Which site is most effective for checking the hash against multiple antivirus engines?

During a suspected breach, you identify a rogue process running on a Linux server. Which command identifies the network socket associated with this process?

Which TWO types of evidence should be collected during the identification phase of an incident?

Which TWO steps are part of the 'Preparation' phase of the incident response process?

You notice an anomaly in your DNS traffic. Which type of DNS record is commonly associated with DNS tunneling for command and control?

A ticket is assigned to you with high priority. What is the first thing you should do?

You are investigating a suspicious login. Which attribute in the Azure AD sign-in logs helps determine if the user successfully authenticated using MFA?

Which TWO pieces of information are critical to include in an initial incident ticket?

Which TWO methods are commonly used to achieve persistence on a Windows host?

Which TWO actions should be taken immediately upon identifying an active malware infection on a workstation?

Which TWO types of logs are most useful for detecting lateral movement?

Which THREE factors should be considered when determining the severity level of an incident?

Which THREE items should be included in a standard incident containment report?

Which TWO items are part of the 'Lessons Learned' process?

Which THREE tools are typically used for forensic memory analysis?

Which THREE actions are appropriate during the eradication phase of a malware incident?

Which THREE factors contribute to 'dwell time' in a security incident?

Which THREE elements are essential in an incident notification email to senior management?

Which TWO indicators should an analyst watch for in a potential phishing campaign?

Which THREE actions are part of the 'Recovery' phase?