Incident Response

Which THREE actions are part of the 'Recovery' phase?

A suspicious PowerShell script is found on an endpoint. Which tool would you use to perform volatile memory analysis to identify if the script injected malicious code?

A SIEM alert indicates multiple failed logins followed by a successful login from a new IP in Splunk Enterprise Security. As a first responder, which dashboard should you navigate to in order to verify the MITRE ATT&CK mapping of this behavior?

Which THREE tools are typically used for forensic memory analysis?

You are managing a containment procedure for an external C2 callback. Which firewall rule configuration is most effective for immediate containment?

A SOC analyst is investigating a suspected data exfiltration incident. Network logs show large outbound transfers to an unfamiliar IP address over HTTPS. The analyst wants to determine if the traffic is malicious command and control (C2) or legitimate business traffic. Which technique should the analyst use to inspect the encrypted payload without terminating the session?

You notice an anomaly in your DNS traffic. Which type of DNS record is commonly associated with DNS tunneling for command and control?

What is the primary goal of the 'Eradication' phase in incident response?

During incident triage, you realize an alert is a False Positive. What is the most appropriate action to take within the SIEM ticketing system?

During an incident response engagement, a SOC analyst needs to acquire volatile memory from a running Windows 10 endpoint before isolating it from the network. The analyst must ensure the memory image is forensically sound and preserves the order of volatility. Which of the following should the analyst do FIRST?

Which TWO steps are part of the 'Preparation' phase of the incident response process?

During a suspected malware incident, a SOC analyst needs to isolate an infected workstation using Microsoft Defender for Endpoint. Which specific action should the analyst select within the Device inventory dashboard?

What is the primary purpose of a 'War Room' during a major incident?

What is the main objective of the 'Post-Incident Activity' phase?

A SOC analyst is reviewing a packet capture from a suspected compromised host. The analyst observes a series of DNS queries for long, random-looking subdomains of a single domain, followed by TXT record responses containing encoded data. Which type of attack is most likely occurring?

Which document is essential for recording every action taken during an incident for legal and audit purposes?

You are remediating a compromised web server. After identifying the web shell, what is the next step to prevent further access?

You are investigating a data exfiltration incident. Which protocol's logs would most likely show large volumes of data being moved to a cloud storage provider?

A ticket is assigned to you with high priority. What is the first thing you should do?

During an incident involving a Windows workstation that exhibits beaconing to an external IP every 60 seconds, you need to preserve volatile evidence before the machine is rebooted. Which of the following should you capture FIRST according to order of volatility?

When an analyst suspects that a malicious user is using a VPN to hide their source IP, which technique is most helpful for attribution?

A SOC analyst is following the organization's incident response plan and has just completed containment of a malware outbreak. According to the NIST SP 800-61 lifecycle, which phase should the analyst perform next?

While using ServiceNow Security Incident Response (SIR), you need to escalate a ticket. What is the standard process to ensure the security manager receives notification?

A SOC analyst is reviewing a suspicious email reported by a user. The email contains a link to a seemingly legitimate website, but the analyst suspects a phishing attempt. Which action should the analyst take to safely analyze the URL without compromising the corporate network?

Which TWO methods are commonly used to achieve persistence on a Windows host?

You are performing triage for an alert involving unauthorized access to an S3 bucket. Which service would you consult to review the API calls made to that bucket?

Which TWO indicators should an analyst watch for in a potential phishing campaign?

Which THREE items should be included in a standard incident containment report?

A SOC analyst is responding to a confirmed ransomware incident on a file server. The analyst must preserve evidence for potential legal action while also containing the threat. Which TWO actions should the analyst perform to maintain forensic soundness during containment? (Choose two.)

Which THREE factors should be considered when determining the severity level of an incident?

During a phishing investigation, you receive a suspicious link. Which safety measure should you use to analyze the link?

Which TWO types of logs are most useful for detecting lateral movement?

A SOC analyst is investigating a suspected ransomware incident on a Windows 10 endpoint. The user reported a pop-up demanding payment, and files have been renamed with a .locked extension. The analyst has isolated the endpoint from the network. Which artifact should the analyst examine FIRST to identify the ransomware variant and potential decryption tools?

During an incident, a SOC analyst needs to preserve volatile memory on a Windows Server 2019 host before shutting it down. The server is running critical services and cannot be taken offline immediately. Which action best preserves the most volatile evidence while minimizing disruption?

In the context of the MITRE ATT&CK framework, what is the primary goal of the 'Command and Control' tactic?

When dealing with a ransomware incident, why should you prioritize disconnecting the host from the network over immediate rebooting?

A SOC analyst is performing post-incident analysis after a successful containment of a malware outbreak. The analyst needs to identify which two Windows Registry locations are commonly used by malware for persistence to ensure they are cleaned. (Choose two.)

Which THREE factors contribute to 'dwell time' in a security incident?

A SOC analyst receives an alert about a possible data exfiltration attempt from a database server. The analyst needs to determine if large amounts of data were transferred outbound. Which network monitoring approach would best provide this information?

What is the primary function of an IOC (Indicator of Compromise) in an incident?

Which TWO pieces of information are critical to include in an initial incident ticket?

In the NIST Incident Response lifecycle, which phase involves the identification of the incident type and scope?

Which TWO items are part of the 'Lessons Learned' process?

You are using an EDR to hunt for persistent scheduled tasks. Which artifact should you analyze to see tasks created within the last 24 hours?

You are triaging an alert in CrowdStrike Falcon. An endpoint shows a 'Suspicious File' detection. To verify the process tree and identify the parent process, which view do you use?

During a suspected lateral movement incident, you observe successful SMB sessions between two workstations. Which tool in Windows can be used to view these active sessions?

Which document should you reference first to determine the communication path during a high-severity security incident?

A SOC analyst is preparing an incident response report for a confirmed phishing incident that led to credential theft. The analyst must document the timeline and impact. Which TWO artifacts should the analyst include to support the timeline and scope of the incident? (Choose two.)

An analyst is reviewing logs in Splunk to investigate a potential exfiltration event. Which field should the analyst focus on to identify the volume of data sent to an external IP?

During an investigation, you need to perform a live acquisition of a suspect's system memory using FTK Imager. What is the correct order of operations to maintain integrity?

While analyzing an incident involving a malicious domain, you need to determine when the domain was registered. Which database should you query?

During a suspected breach, you identify a rogue process running on a Linux server. Which command identifies the network socket associated with this process?

Which THREE actions are appropriate during the eradication phase of a malware incident?

You need to verify if an executable is malicious. Which site is most effective for checking the hash against multiple antivirus engines?

A SOC analyst receives an alert that a domain controller is generating a high volume of Kerberos ticket-granting service (TGS) requests with RC4 encryption for various service principal names. The analyst suspects a Kerberoasting attack. Which Windows event ID should the analyst prioritize to confirm the attack?

Which THREE elements are essential in an incident notification email to senior management?