212-89 Incident Handling Process — 20 Questions

Question 1

You are configuring an automated incident response workflow in TheHive. Which specific configuration parameter must be validated to ensure that the incident triage phase correctly captures the 'Impact' and 'Urgency' fields for reporting?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The 'Custom Fields' definition within the incident template configuration. In TheHive, these fields are part of the incident template configuration, and incorrect mapping leads to failed data normalization during the ingestion phase.

Answer

The 'Elasticsearch' index prefix in system settings

Answer

The 'Analyzer' timeout setting in the application.conf file

Answer

The 'Cortex' connection string in the GUI settings

Question 2

During a suspected data breach, you must collect volatile memory. Which tool and command is the industry-standard starting point for capturing an image of RAM in a Windows-based incident?

Accepted Answer

FTK Imager Memory Capture. FTK Imager is widely used for creating forensic images of volatile memory on Windows systems.

Answer

Netstat -an

Answer

Windows Task Manager dump

Answer

WinPcap capture

Question 3

Which role in the Incident Response Team is primarily responsible for ensuring that the incident handling activities remain aligned with organizational legal and privacy requirements?

Accepted Answer

Legal Counsel. The legal counsel or representative ensures that all actions taken during an incident are compliant with applicable laws.

Answer

Technical Investigator

Answer

Incident Lead

Answer

Communications Officer

Question 4

You are managing chain of custody for a physical server seized during an investigation. What is the most critical action to ensure the evidence remains admissible in court?

Accepted Answer

Logging every individual who accessed, transported, or stored the device. Maintaining a verifiable, gapless log of every person who touched the evidence is the core requirement of chain of custody.

Answer

Taking photographs of the server location

Answer

Using an anti-static bag for transport

Answer

Hashing the drive contents immediately

Question 5

You are performing a post-incident review. Which action is the most important to ensure that the 'Lessons Learned' process effectively improves future response capabilities?

Accepted Answer

Documenting the root cause and defining specific, actionable process changes. The root cause analysis and resulting action items are what drive actual improvement in the IR lifecycle.

Answer

Updating the password policy

Answer

Archiving all forensic images for ten years

Answer

Assigning blame to the employee who made the error

Question 6

You are setting up a secure communication channel for the IR team during a major incident. Why is it recommended to use an out-of-band communication method?

Accepted Answer

To prevent the attacker from monitoring team communications. If the primary network is compromised, internal communication (email/Slack) may be monitored by the attacker.

Answer

To comply with the Acceptable Use Policy

Answer

To simplify documentation for the final report

Answer

To increase bandwidth for file transfers

Question 7

You are establishing an Incident Response Plan (IRP). Which document should prioritize the technical steps for restoring services after a ransomware attack?

Accepted Answer

Playbook. The Incident Response Plan focuses on the procedural steps for handling specific incident types, including recovery.

Answer

Business Continuity Plan

Answer

Communication Plan

Answer

Security Policy

Question 8

You suspect an incident involves an insider threat. Which step should be taken FIRST to preserve the integrity of the potential evidence while minimizing system downtime?

Accepted Answer

Capture a bit-stream image of the storage media. Creating a forensic image ensures that the current state is preserved before any volatile data is lost or system state changes.

Answer

Change the root password to lock out the attacker

Answer

Delete the suspicious user account

Answer

Reboot the compromised system to clear malicious memory

Question 9

A department head demands to know the names of the employees involved in an internal data leak. Which policy document defines your obligation to disclose or withhold this information?

Accepted Answer

Incident Communication Policy. The communication and disclosure policy defines the rules for internal and external information sharing during an incident.

Answer

Acceptable Use Policy

Answer

Access Control Policy

Answer

Data Classification Policy

Question 10

You have identified a potential Advanced Persistent Threat (APT) in your network. Which evidence preservation strategy is required to maintain the validity of the logs found in a SIEM?

Accepted Answer

Applying a cryptographic hash to the exported logs. Generating cryptographic hashes for log files ensures they can be verified as untampered during later analysis.

Answer

Moving the logs to a backup server

Answer

Printing the logs to a secure PDF

Answer

Taking a screenshot of the SIEM dashboard

Question 11

You are documenting a post-incident review. Which of the following should be included in the 'Timeline of Events' section?

Accepted Answer

The chronological order of detection, analysis, and containment actions. An accurate timeline must include the exact time an event was detected and every response action taken.

Answer

A list of all employees who were working during the incident

Answer

The cost estimate for all hardware replaced

Answer

The personal opinion of the investigators on who was responsible

Question 12

During the identification phase, you notice a high volume of traffic from an unknown IP to your web server. What is the most appropriate action to take first?

Accepted Answer

Analyze the traffic logs to determine the nature of the activity. Analyzing the traffic confirms whether it is an attack or benign activity before taking disruptive action.

Answer

Block the IP at the firewall immediately

Answer

Notify the local law enforcement

Answer

Shut down the web server

Question 13

When classifying the severity of an incident, which factor should carry the most weight in your decision-making process?

Accepted Answer

The potential impact on business availability and data integrity. The impact on business operations is the most significant factor in determining the urgency and scope of the response.

Answer

The number of security tools that flagged the alert

Answer

The time of day the incident occurred

Answer

The technical complexity of the exploit

Question 14

You are dealing with a legal hold request for data related to an investigation. How should you handle the data retention policy for this specific case?

Accepted Answer

Suspend the automatic deletion for the affected data. A legal hold overrides existing retention policies, preventing the automatic deletion of relevant data.

Answer

Export the data to a public cloud storage service

Answer

Follow the standard 90-day retention policy

Answer

Delete the data and generate an audit log

Question 15

An incident handler is reviewing an alert from the Endpoint Detection and Response (EDR) system. What is the main goal of the 'Containment' phase?

Accepted Answer

To limit the scope and damage of the incident. The primary goal of containment is to stop the spread of the attack and prevent further damage.

Answer

To identify the attacker

Answer

To analyze the root cause

Answer

To recover normal operations

Question 16

Which of the following activities is best suited for the 'Recovery' phase of the incident handling process?

Accepted Answer

Scanning for vulnerabilities to ensure the exploit vector is closed. Recovery involves restoring systems to a clean state, which includes verifying patches and security controls.

Answer

Isolating infected hosts from the network

Answer

Interviewing employees about the incident

Answer

Notifying the media of the breach

Question 17

What is the primary function of an Incident Response (IR) policy?

Accepted Answer

To establish the authority and framework for incident management. An IR policy provides the high-level authority and framework for how an organization prepares for and responds to incidents.

Answer

To monitor network traffic for threats

Answer

To define the budget for new security tools

Answer

To provide step-by-step instructions for patching servers

Question 18

Which team should be notified first in the event of a confirmed external data breach involving customer PII?

Accepted Answer

Legal and Privacy officers. Legal and Data Privacy teams must be involved early to handle regulatory compliance and notifications.

Answer

The local news media

Answer

The marketing department

Answer

The software development team

Question 19

When dealing with digital evidence in a remote investigation, what is the standard procedure to ensure evidence integrity during network transfer?

Accepted Answer

Use a secure, encrypted tunnel and verify hashes at the destination. Using encrypted, secure tunnels and verifying hashes at both ends is the standard for remote forensic collection.

Answer

Compress the data using zip files to reduce file size

Answer

Email the files to the lead investigator

Answer

Transfer the data over FTP to a staging server

Question 20

You are using a SIEM to correlate events during an investigation. What is the primary advantage of correlation in incident analysis?

Accepted Answer

It links related alerts to show the attack progression. Correlation links disparate events across different devices to reveal the full attack path.

Answer

It reduces the amount of storage required for logs

Answer

It automatically blocks all suspicious traffic

Answer

It replaces the need for human analysis