CSS Incident Response & Recovery 2 — Questions and Answers
Question 1: During the containment phase of incident response, which strategy isolates a compromised host while preserving its network traffic data for forensic analysis?
- Shutdown the host immediately
- Network-based containment using ACLs or VLAN isolation (Correct answer)
- Wipe and reimage the host
- Disable the user account only
Correct answer: Network-based containment using ACLs or VLAN isolation
Network-based containment via ACLs or VLAN isolation limits the attacker's lateral movement while keeping the host running for forensic evidence capture.
Question 2: What is the primary purpose of a 'lessons learned' meeting after a security incident?
- Assign blame to responsible team members
- Document what happened and improve future response processes (Correct answer)
- Notify affected customers of the breach
- Restore all compromised systems to production
Correct answer: Document what happened and improve future response processes
The lessons learned meeting captures what worked, what failed, and identifies process improvements to strengthen future incident response.
Question 3: Which chain-of-custody principle is MOST critical when handling digital evidence collected during an incident?
- Ensuring evidence is encrypted at rest
- Documenting every person who accessed the evidence (Correct answer)
- Storing evidence on isolated network drives
- Compressing evidence files to save storage space
Correct answer: Documenting every person who accessed the evidence
Chain of custody requires a complete, unbroken record of everyone who accessed the evidence to ensure its integrity and admissibility.
Question 4: An IR team discovers that an attacker maintained persistence via a scheduled task. Which recovery step should be performed FIRST?
- Patch the vulnerability used for initial access
- Remove the malicious scheduled task (Correct answer)
- Notify law enforcement
- Restore from backup
Correct answer: Remove the malicious scheduled task
Removing the persistence mechanism first ensures the attacker cannot regain access before other remediation steps are completed.
Question 5: What does the term 'dwell time' refer to in the context of incident response?
- Time spent in the containment phase
- Time between initial compromise and detection (Correct answer)
- Time required to restore systems after an incident
- Time needed to notify stakeholders
Correct answer: Time between initial compromise and detection
Dwell time measures how long an attacker remains undetected in the environment, and reducing it is a key metric for IR effectiveness.
Question 6: Which artifact type would BEST help an analyst determine the timeline of an attacker's lateral movement across Windows systems?
- Windows Event Log 4624 (logon events) (Correct answer)
- Browser history files
- Installed software registry keys
- Firewall rule configurations
Correct answer: Windows Event Log 4624 (logon events)
Windows Event ID 4624 records successful logons, making it the primary source for reconstructing lateral movement timelines.
Question 7: When an organization declares a cyber incident a 'major incident,' what typically triggers this escalation?
- Any detection of malware on a single endpoint
- Impact to critical business systems or regulatory thresholds exceeded (Correct answer)
- A single phishing email received by an employee
- Detection of a port scan from an external IP
Correct answer: Impact to critical business systems or regulatory thresholds exceeded
Major incident declarations are triggered by significant business impact, such as outages to critical systems or breaches crossing regulatory notification thresholds.
CSS Incident Response & Recovery 2
During the containment phase of incident response, which strategy isolates a compromised host while preserving its network traffic data for forensic analysis?