49 questions · Incident Response topic · All types, answers revealed
Which THREE actions are part of the 'Recovery' phase?
Critical for stability post-restore.
Why this answer
Restoring systems from clean backups, monitoring for reinfection, and validating system integrity are recovery actions.
A suspicious PowerShell script is found on an endpoint. Which tool would you use to perform volatile memory analysis to identify if the script injected malicious code?
Volatility is designed for analyzing process memory structures.
Why this answer
Volatility is the industry-standard tool for memory forensics and analysis of injected code.
A SIEM alert indicates multiple failed logins followed by a successful login from a new IP in Splunk Enterprise Security. As a first responder, which dashboard should you navigate to in order to verify the MITRE ATT&CK mapping of this behavior?
Incident Review provides the contextual mapping to MITRE ATT&CK.
Why this answer
The Incident Review dashboard allows analysts to view the MITRE ATT&CK tactics and techniques associated with notable events.
Which THREE tools are typically used for forensic memory analysis?
Industry standard tool.
Why this answer
Volatility, MemProcFS, and Rekall are the primary tools used for memory forensics.
You are analyzing an alert for a suspicious PowerShell command. Which logging setting must be enabled on Windows endpoints to capture the full command-line arguments?
This logs the full content of the script block executed.
Why this answer
Script Block Logging (Event ID 4104) is required to capture the full content of executed PowerShell scripts.
You are managing a containment procedure for an external C2 callback. Which firewall rule configuration is most effective for immediate containment?
This terminates the C2 channel immediately.
Why this answer
Blocking the egress connection to the specific malicious IP at the perimeter firewall is the fastest way to stop C2 communication.
You notice an anomaly in your DNS traffic. Which type of DNS record is commonly associated with DNS tunneling for command and control?
TXT records can store arbitrary string data used for tunneling.
Why this answer
TXT records are commonly used in DNS tunneling to encode data within the record's payload.
What is the primary goal of the 'Eradication' phase in incident response?
Eradication is the process of cleaning the environment.
Why this answer
To remove all traces of the threat (malware, backdoors, compromised accounts) from the environment.
During incident triage, you realize an alert is a False Positive. What is the most appropriate action to take within the SIEM ticketing system?
This follows standard lifecycle management for SOC tickets.
Why this answer
Closing the ticket as 'False Positive' with a mandatory comment ensures the audit trail reflects why the alert was dismissed.
Which TWO steps are part of the 'Preparation' phase of the incident response process?
Preparedness depends on capable staff.
Why this answer
Having tools and policies in place is what preparation is all about.
During a suspected malware incident, a SOC analyst needs to isolate an infected workstation using Microsoft Defender for Endpoint. Which specific action should the analyst select within the Device inventory dashboard?
Isolate device is the correct action to contain the threat by severing network connectivity.
Why this answer
Isolate device stops network traffic to the host while keeping the communication with the Microsoft Defender for Endpoint service open.
What is the primary purpose of a 'War Room' during a major incident?
This is the definition of a war room purpose.
Why this answer
To centralize communication, expedite decision-making, and coordinate response efforts among stakeholders.
What is the main objective of the 'Post-Incident Activity' phase?
This is the core objective of the lessons learned meeting.
Why this answer
To learn from the incident to improve future response, capabilities, and security posture.
Which document is essential for recording every action taken during an incident for legal and audit purposes?
The log ensures accountability and traceability.
Why this answer
An Incident Log (or Journal) is mandatory for maintaining a chronological record of all response actions.
You are remediating a compromised web server. After identifying the web shell, what is the next step to prevent further access?
This removes the access point and invalidates any credentials stolen.
Why this answer
After identifying the web shell, removing the file and resetting the web application credentials is the critical next step.
You are investigating a data exfiltration incident. Which protocol's logs would most likely show large volumes of data being moved to a cloud storage provider?
These logs show the destination URL and volume of data transferred.
A ticket is assigned to you with high priority. What is the first thing you should do?
Scoping and validation are the first steps in triage.
Why this answer
Verify the alert's validity to ensure it is not a false positive before proceeding with full containment.
Which TWO types of evidence should be collected during the identification phase of an incident?
Crucial for audit trail.
Why this answer
Logs and disk images provide the raw data necessary for reconstruction.
When an analyst suspects that a malicious user is using a VPN to hide their source IP, which technique is most helpful for attribution?
This is the standard approach to identify proxy/VPN usage.
Why this answer
Reviewing connection logs for anomalous login times and comparing them against known VPN exit node lists is the primary technique.
While using ServiceNow Security Incident Response (SIR), you need to escalate a ticket. What is the standard process to ensure the security manager receives notification?
Using @mentions within the work notes notifies the relevant stakeholders via the platform.
Why this answer
Updating the 'Assigned to' or 'Assignment group' fields while using the 'Work notes' to trigger a business rule notification is the standard workflow.
Which TWO methods are commonly used to achieve persistence on a Windows host?
Classic persistence technique.
Why this answer
Scheduled tasks and Registry run keys are the most common methods for maintaining persistence.
You are performing triage for an alert involving unauthorized access to an S3 bucket. Which service would you consult to review the API calls made to that bucket?
CloudTrail records all API activity.
Why this answer
AWS CloudTrail logs all API calls made within an AWS account, including S3 operations.
Which TWO indicators should an analyst watch for in a potential phishing campaign?
Primary indicator of spoofing.
Why this answer
Unusual sender addresses and urgent language are classic phishing indicators.
Which THREE items should be included in a standard incident containment report?
Required for situational awareness.
Why this answer
The report must detail what was done, when, and the status of the containment.
Which THREE factors should be considered when determining the severity level of an incident?
Critical for severity.
Why this answer
Impact, urgency, and the sensitivity of the data define severity.
During a phishing investigation, you receive a suspicious link. Which safety measure should you use to analyze the link?
This protects the analyst's machine while allowing investigation.
Why this answer
A secure sandbox or isolated browser provides a safe environment to observe the link's behavior.
Which TWO types of logs are most useful for detecting lateral movement?
Detects account movement.
Why this answer
Authentication logs (logons) and network traffic (NetFlow/SMB) are the primary indicators of lateral movement.
You are auditing user access logs for a potential privilege escalation. What indicates that a user has successfully used 'runas' to switch context?
Logon Type 9 indicates a 'NewCredentials' logon, typical of runas.
Why this answer
Event ID 4672 (Special privileges assigned to new logon) combined with 4624 (Logon type 9) indicates a runas session.
In the context of the MITRE ATT&CK framework, what is the primary goal of the 'Command and Control' tactic?
C2 is defined by the maintainance of communication.
Why this answer
The goal is to maintain communication between the compromised system and the attacker's infrastructure.
When dealing with a ransomware incident, why should you prioritize disconnecting the host from the network over immediate rebooting?
Memory contains keys and malicious process artifacts that are lost on reboot.
Why this answer
Rebooting can cause the ransomware to execute encryption routines or clear volatile memory artifacts needed for forensics.
Which THREE factors contribute to 'dwell time' in a security incident?
Poor visibility leads to delayed detection.
Why this answer
Dwell time is the duration between the start of an intrusion and its detection.
You need to export a PCAP for a suspicious network flow. Using Wireshark, which filter would you use to isolate traffic from a specific suspicious source IP 192.168.1.50?
This correctly filters for source traffic only.
Why this answer
The 'ip.src' filter isolates traffic originating from the specified source IP.
What is the primary function of an IOC (Indicator of Compromise) in an incident?
IOCs provide empirical evidence to confirm and trace a threat.
Why this answer
IOCs act as signatures or artifacts that help confirm the presence of a threat.
Which TWO actions should be taken immediately upon identifying an active malware infection on a workstation?
Prevents the attacker from continuing to use the compromised creds.
Why this answer
Isolating the host prevents spreading; disconnecting the network allows for forensics without alerting the malware to changes.
Which TWO pieces of information are critical to include in an initial incident ticket?
Scopes the impact.
Why this answer
Knowing who is affected and the source of the alert is critical for triage.
In the NIST Incident Response lifecycle, which phase involves the identification of the incident type and scope?
This phase formally identifies the incident and its characteristics.
Why this answer
The Detection and Analysis phase focuses on identifying, validating, and scoping the incident.
Which TWO items are part of the 'Lessons Learned' process?
Core goal of the meeting.
Why this answer
Identifying what went wrong and what went right improves future responses.
You are using an EDR to hunt for persistent scheduled tasks. Which artifact should you analyze to see tasks created within the last 24 hours?
Event ID 4698 captures scheduled task creation.
Why this answer
The Task Scheduler event logs, specifically Event ID 4698, document the creation of scheduled tasks.
This indicates whether MFA was satisfied.
You are triaging an alert in CrowdStrike Falcon. An endpoint shows a 'Suspicious File' detection. To verify the process tree and identify the parent process, which view do you use?
The Process Tree displays the parent-child relationships of execution.
Why this answer
The Process Tree in CrowdStrike Falcon visualizes the genealogy of the process that triggered the detection.
During a suspected lateral movement incident, you observe successful SMB sessions between two workstations. Which tool in Windows can be used to view these active sessions?
This command lists current SMB sessions.
Why this answer
The 'net sessions' or 'net file' command provides info on local sessions, but 'Get-SmbSession' is the modern PowerShell equivalent for this analysis.
Which document should you reference first to determine the communication path during a high-severity security incident?
IRP provides the necessary communication structure.
Why this answer
The Incident Response Plan (IRP) specifically defines the roles, responsibilities, and communication channels for incidents.
An analyst is reviewing logs in Splunk to investigate a potential exfiltration event. Which field should the analyst focus on to identify the volume of data sent to an external IP?
This field tracks data egress volume.
Why this answer
In common flow logs like NetFlow or firewall logs, 'bytes_sent' or 'bytes_out' indicates the amount of data transferred.
During an investigation, you need to perform a live acquisition of a suspect's system memory using FTK Imager. What is the correct order of operations to maintain integrity?
Memory is volatile and must be captured before disk.
Why this answer
Always capture volatile memory first, then disk, as memory changes constantly.
While analyzing an incident involving a malicious domain, you need to determine when the domain was registered. Which database should you query?
WHOIS contains registration history and dates.
Why this answer
WHOIS databases provide registration details for domain names.
During a suspected breach, you identify a rogue process running on a Linux server. Which command identifies the network socket associated with this process?
The -p flag shows the PID associated with the socket.
Why this answer
The 'netstat -tulnp' or 'ss -tulnp' command shows the process ID alongside the listening socket.
Which THREE actions are appropriate during the eradication phase of a malware incident?
Prevents re-infection.
Why this answer
Cleaning the malware, patching the vulnerability, and scanning the environment are core eradication steps.
You need to verify if an executable is malicious. Which site is most effective for checking the hash against multiple antivirus engines?
VirusTotal checks hashes against a massive engine database.
Why this answer
VirusTotal aggregates results from multiple AV vendors, providing a comprehensive report on a file hash.
Which THREE elements are essential in an incident notification email to senior management?
Management cares about the bottom line.
Why this answer
Management needs to know the impact, current status, and next steps.
Ready to test yourself?
Try a timed practice session using only Incident Response questions.