During a suspected data breach, you must collect volatile memory. Which tool and command is the industry-standard starting point for capturing an image of RAM in a Windows-based incident?
A department head demands to know the names of the employees involved in an internal data leak. Which policy document defines your obligation to disclose or withhold this information?
You are configuring an automated incident response workflow in TheHive. Which specific configuration parameter must be validated to ensure that the incident triage phase correctly captures the 'Impact' and 'Urgency' fields for reporting?
During a ransomware outbreak, the incident response team lead must decide whether to disconnect a critically infected file server from the network. The server hosts a database that a revenue-generating application depends on. The team has already collected volatile data and a forensic image. Which containment approach best balances incident impact with business continuity?
A financial services firm has just confirmed a ransomware infection on several endpoints. The incident response team is preparing to contain the incident while preserving the ability to investigate and recover. Which TWO of the following containment actions are MOST appropriate at this stage? (Choose two.)
Which role in the Incident Response Team is primarily responsible for ensuring that the incident handling activities remain aligned with organizational legal and privacy requirements?
You are managing chain of custody for a physical server seized during an investigation. What is the most critical action to ensure the evidence remains admissible in court?
You are performing a post-incident review. Which action is the most important to ensure that the 'Lessons Learned' process effectively improves future response capabilities?
You are setting up a secure communication channel for the IR team during a major incident. Why is it recommended to use an out-of-band communication method?
You are establishing an Incident Response Plan (IRP). Which document should prioritize the technical steps for restoring services after a ransomware attack?
You suspect an incident involves an insider threat. Which step should be taken FIRST to preserve the integrity of the potential evidence while minimizing system downtime?
You have identified a potential Advanced Persistent Threat (APT) in your network. Which evidence preservation strategy is required to maintain the validity of the logs found in a SIEM?
During the identification phase, you notice a high volume of traffic from an unknown IP to your web server. What is the most appropriate action to take first?
You are dealing with a legal hold request for data related to an investigation. How should you handle the data retention policy for this specific case?
You are preparing a final report for an incident. Which element is mandatory for ensuring the report serves as a valid document for future insurance or legal claims?
During an investigation, you need to verify the integrity of a system configuration file. You have the original known-good hash. What does it mean if the hash of the current file matches the known-good hash?
You are utilizing NIST SP 800-61 Rev. 2 to structure your incident response team. During a critical ransomware outbreak, you need to assign a lead who coordinates with legal, PR, and executive leadership. Which role should you designate to ensure organizational communication is handled per the policy?
While investigating a server compromise, you need to ensure the digital evidence collected from the RAID array is admissible in court. What is the most critical requirement for the chain of custody?
During the lessons learned phase of a P1 incident, you notice that the incident handling policy failed to define clear 'Rules of Engagement' for containment, leading to accidental service disruption. Which document should be updated to address this deficiency?
You are reviewing a failed incident case management report. The team failed to capture the 'Time of Detection' vs. 'Time of Occurrence'. Which metric is directly impacted by this lack of documentation?
You are performing an incident investigation involving a suspected insider threat. Under GDPR compliance, you must ensure that your data collection methods adhere to the 'data minimization' principle. Which action best aligns with this requirement?
An organization is establishing an Incident Response (IR) team. According to NIST, which team structure is most suitable for a large, globally distributed organization that requires localized response capability with centralized oversight?
When managing the 'Lessons Learned' phase of the incident response lifecycle, which THREE activities should be conducted to ensure continuous improvement?
During an incident, a security analyst discovers that a compromised workstation is communicating with a known malicious IP address. The analyst wants to block the IP at the perimeter firewall. Which phase of the incident handling process does this action fall under?
A security team is reviewing their incident handling process after a recent data breach. They want to ensure that their eradication phase is effective. Which TWO activities are essential during the eradication phase? (Choose two.)
A security analyst is documenting an incident that involved unauthorized access to a database. The analyst needs to record the timeline of events. Which phase of the incident handling process includes documenting the timeline?
You are an incident handler assigned to a case involving a suspected insider threat. Before collecting evidence from an employee's workstation, you must ensure your actions are legally defensible and compliant with company policy. Which document should you consult FIRST to determine your authority to search and seize the workstation?
During the containment phase of a ransomware incident, you must decide whether to disconnect the infected host from the network or keep it connected for monitoring. The host is encrypting files on a shared network drive. Which action should you take FIRST to limit the spread while preserving evidence?
You are leading the eradication phase of a malware incident. Which TWO activities are essential to ensure the malware is completely removed and the system is restored to a trusted state? (Choose two.)
During a live incident, an analyst needs to capture volatile data from a compromised Windows server before containment. The server has 32 GB of RAM and is still running. Which action should the analyst perform FIRST to preserve the most volatile evidence?
After a major security breach, you are tasked with conducting a lessons learned meeting. Which of the following is the PRIMARY objective of this meeting?
An organization's CSIRT is activated for a suspected ransomware outbreak. The incident handler must decide whether to escalate the incident to management. According to the incident handling process, which factor is the MOST appropriate trigger for immediate escalation?
A hospital's incident response team has just finished eradicating a ransomware infection that encrypted several clinical workstations. The CISO asks the handler to formally close the incident and release the team. According to the incident handling process, which activity must occur BEFORE the incident can be declared closed?
An incident handler is preparing the containment strategy for a compromised workstation that is communicating with a command-and-control server. Which TWO actions are appropriate immediate containment measures? (Choose two.)
A security analyst receives an alert about a possible data exfiltration from a compromised workstation. The analyst needs to determine the scope of the incident by identifying other systems that may have communicated with the same command-and-control (C2) server. Which data source is most effective for this correlation during the identification phase?
A handler is documenting a confirmed breach of a customer database. Legal counsel needs to know the earliest point at which the organization 'knew' the incident occurred for regulatory reporting deadlines. During which phase of the incident handling process does this formal determination of incident occurrence typically get made?
After containing a malware incident, the incident response team needs to remove the malware from infected systems and restore them to a trusted state. Which activity is part of the eradication phase?
An incident handler is documenting the timeline of a security breach. The handler discovers that system clocks on different servers are not synchronized. Which action should the handler take to ensure the timeline is accurate and defensible?
A financial services firm has activated its incident response plan after detecting unauthorized access to an internal file server. The incident commander must decide which activities belong to the containment phase rather than recovery. (Choose two.)
An organization's incident response team is drafting its first formal incident handling capability. Management asks which phase of the process should include developing the incident response plan, acquiring forensic tools, and training the team before any real event occurs.
An organization is conducting a post-incident review after a major data breach. The team must document the incident timeline, root cause, and corrective actions. Which phase of the incident handling process does this activity belong to?
During the preparation phase, an organization is developing its incident response plan. Which TWO of the following are essential elements that should be included to ensure effective incident handling? (Choose two.)
During a live intrusion, the incident commander must choose a containment strategy. Taking the affected system offline immediately would destroy volatile memory evidence and alert the attacker, while leaving it online risks further data exfiltration. Which approach best balances evidence preservation with damage limitation?
A healthcare provider's incident response team is notified that a clinical workstation is repeatedly re-infecting with ransomware 20 minutes after each cleanup. Volatile evidence has been preserved, and the business owner has authorized taking the endpoint offline. The team suspects a persistent mechanism that re-establishes the payload. Which action BEST aligns with the Containment phase of the incident handling process while preserving the ability to identify the persistence mechanism?
A junior SOC analyst receives an alert at 03:00 showing a workstation contacting a known command-and-control (C2) IP address. The analyst is unsure whether this is a true incident or a false positive and wants guidance before waking the on-call incident handler. According to the incident handling process, what should the analyst do FIRST?
An incident handler is preparing to collect volatile evidence from a compromised Linux server that is still running. The handler must decide which data to capture first before memory-resident artifacts are lost. Which of the following should be collected FIRST?
During an incident investigation, the handler discovers that an attacker used a compromised service account to move laterally across multiple servers. The handler needs to determine the full scope of affected systems. Which of the following is the MOST reliable method to identify all systems the attacker accessed using that account?
An organization's incident response plan defines a communication protocol for notifying stakeholders during an incident. A major security breach has just been confirmed, and the incident handler must decide who to notify and how. Which of the following is the PRIMARY factor that should guide the notification process?