CCST Security Incident Handling Process 2 — Questions and Answers
Question 1: What is the first step in the NIST incident response lifecycle?
- Detection and Analysis
- Containment, Eradication, and Recovery
- Preparation (Correct answer)
- Post-Incident Activity
Correct answer: Preparation
Preparation involves establishing the CSIRT, creating policies, deploying tools, and conducting training.
NIST SP 800-61 lifecycle: Preparation, Detection and Analysis, Containment/Eradication/Recovery, Post-Incident Activity. Preparation includes forming the team, developing procedures, deploying detection tools, and conducting exercises.
Question 2: What is the difference between short-term and long-term containment?
- Short-term involves patching; long-term involves monitoring
- Short-term stops immediate damage; long-term implements sustainable controls during investigation (Correct answer)
- Short-term notifies management; long-term notifies law enforcement
- No difference; containment is single-step
Correct answer: Short-term stops immediate damage; long-term implements sustainable controls during investigation
Short-term: rapid actions to stop spread. Long-term: sustainable controls allowing continued operations during investigation.
Short-term: isolate machines, block IPs, disable accounts (minutes to hours). Long-term: rebuild on clean images, add monitoring, apply emergency patches, redirect traffic (days to weeks). Short-term buys time for long-term.
Question 3: Why is maintaining chain of custody important during incident handling?
- To speed up response
- To ensure digital evidence is properly documented, preserved, and admissible in legal proceedings (Correct answer)
- To prevent employees from learning about the incident
- To reduce cost
Correct answer: To ensure digital evidence is properly documented, preserved, and admissible in legal proceedings
Chain of custody documents every handler of evidence, ensuring integrity and court admissibility.
Includes: who collected (name, date, time), what (serial numbers, hashes), how (tools used), where stored (access logs), and every transfer. Write-blockers, SHA-256 hashes, tamper-evident bags, and limited access are best practices.
Question 4: What is the purpose of the eradication phase?
- To notify customers
- To completely remove the threat and its artifacts from all affected systems (Correct answer)
- To restore from backup
- To document the incident
Correct answer: To completely remove the threat and its artifacts from all affected systems
Eradication removes all malware, backdoors, and unauthorized changes, and patches exploited vulnerabilities.
Actions: remove malware, delete backdoors, patch vulnerabilities, reset compromised credentials, reimage systems, verify removal. Incomplete eradication is a common failure since attackers establish multiple persistence mechanisms.
Question 5: What should a lessons learned meeting focus on after an incident?
- Assigning blame
- Analyzing what happened, what worked, what could improve, and how to prevent recurrence (Correct answer)
- Planning the annual budget
- Training on basic computer skills
Correct answer: Analyzing what happened, what worked, what could improve, and how to prevent recurrence
Post-incident review evaluates response effectiveness and produces actionable improvements.
Conduct within 1-2 weeks. Cover timeline, detection speed, plan adherence, gaps, and needed tools/training. Produce written report with actionable recommendations, assigned owners, and deadlines. Use blameless postmortem approach.
Question 6: What role does a SIEM play in incident detection?
- It patches vulnerabilities automatically
- It collects, correlates, and analyzes log data from multiple sources to identify potential incidents (Correct answer)
- It blocks all incoming traffic
- It encrypts data at rest
Correct answer: It collects, correlates, and analyzes log data from multiple sources to identify potential incidents
SIEM aggregates logs from across the network, correlates events using rules, and generates alerts for potential incidents.
Collects from firewalls, IDS, servers, endpoints, cloud. Correlation detects multi-stage attacks invisible in individual logs. Modern SIEMs add UEBA and machine learning for anomaly detection.
CCST Security Incident Handling Process 2
What is the first step in the NIST incident response lifecycle?