Incident Response

Which THREE actions are part of the 'Recovery' phase?

A suspicious PowerShell script is found on an endpoint. Which tool would you use to perform volatile memory analysis to identify if the script injected malicious code?

A SIEM alert indicates multiple failed logins followed by a successful login from a new IP in Splunk Enterprise Security. As a first responder, which dashboard should you navigate to in order to verify the MITRE ATT&CK mapping of this behavior?

Which THREE tools are typically used for forensic memory analysis?

You are analyzing an alert for a suspicious PowerShell command. Which logging setting must be enabled on Windows endpoints to capture the full command-line arguments?

You are managing a containment procedure for an external C2 callback. Which firewall rule configuration is most effective for immediate containment?

You notice an anomaly in your DNS traffic. Which type of DNS record is commonly associated with DNS tunneling for command and control?

What is the primary goal of the 'Eradication' phase in incident response?

During incident triage, you realize an alert is a False Positive. What is the most appropriate action to take within the SIEM ticketing system?

Which TWO steps are part of the 'Preparation' phase of the incident response process?

During a suspected malware incident, a SOC analyst needs to isolate an infected workstation using Microsoft Defender for Endpoint. Which specific action should the analyst select within the Device inventory dashboard?

What is the primary purpose of a 'War Room' during a major incident?

What is the main objective of the 'Post-Incident Activity' phase?

Which document is essential for recording every action taken during an incident for legal and audit purposes?

You are remediating a compromised web server. After identifying the web shell, what is the next step to prevent further access?

You are investigating a data exfiltration incident. Which protocol's logs would most likely show large volumes of data being moved to a cloud storage provider?

A ticket is assigned to you with high priority. What is the first thing you should do?

Which TWO types of evidence should be collected during the identification phase of an incident?

When an analyst suspects that a malicious user is using a VPN to hide their source IP, which technique is most helpful for attribution?

While using ServiceNow Security Incident Response (SIR), you need to escalate a ticket. What is the standard process to ensure the security manager receives notification?

Which TWO methods are commonly used to achieve persistence on a Windows host?

You are performing triage for an alert involving unauthorized access to an S3 bucket. Which service would you consult to review the API calls made to that bucket?

Which TWO indicators should an analyst watch for in a potential phishing campaign?

Which THREE items should be included in a standard incident containment report?

Which THREE factors should be considered when determining the severity level of an incident?

During a phishing investigation, you receive a suspicious link. Which safety measure should you use to analyze the link?

Which TWO types of logs are most useful for detecting lateral movement?

You are auditing user access logs for a potential privilege escalation. What indicates that a user has successfully used 'runas' to switch context?

In the context of the MITRE ATT&CK framework, what is the primary goal of the 'Command and Control' tactic?

When dealing with a ransomware incident, why should you prioritize disconnecting the host from the network over immediate rebooting?

Which THREE factors contribute to 'dwell time' in a security incident?

You need to export a PCAP for a suspicious network flow. Using Wireshark, which filter would you use to isolate traffic from a specific suspicious source IP 192.168.1.50?

What is the primary function of an IOC (Indicator of Compromise) in an incident?

Which TWO actions should be taken immediately upon identifying an active malware infection on a workstation?

Which TWO pieces of information are critical to include in an initial incident ticket?

In the NIST Incident Response lifecycle, which phase involves the identification of the incident type and scope?

Which TWO items are part of the 'Lessons Learned' process?

You are using an EDR to hunt for persistent scheduled tasks. Which artifact should you analyze to see tasks created within the last 24 hours?

You are investigating a suspicious login. Which attribute in the Azure AD sign-in logs helps determine if the user successfully authenticated using MFA?

You are triaging an alert in CrowdStrike Falcon. An endpoint shows a 'Suspicious File' detection. To verify the process tree and identify the parent process, which view do you use?

During a suspected lateral movement incident, you observe successful SMB sessions between two workstations. Which tool in Windows can be used to view these active sessions?

Which document should you reference first to determine the communication path during a high-severity security incident?

An analyst is reviewing logs in Splunk to investigate a potential exfiltration event. Which field should the analyst focus on to identify the volume of data sent to an external IP?

During an investigation, you need to perform a live acquisition of a suspect's system memory using FTK Imager. What is the correct order of operations to maintain integrity?

While analyzing an incident involving a malicious domain, you need to determine when the domain was registered. Which database should you query?

During a suspected breach, you identify a rogue process running on a Linux server. Which command identifies the network socket associated with this process?

Which THREE actions are appropriate during the eradication phase of a malware incident?

You need to verify if an executable is malicious. Which site is most effective for checking the hash against multiple antivirus engines?

Which THREE elements are essential in an incident notification email to senior management?