Cyber Security Incident Response

Question 1

What is the first step in the NIST incident response lifecycle?

Accepted Answer

Preparation

Answer

Detection and Analysis

Answer

Containment

Answer

Post-Incident Activity

Question 2

What does containment in incident response aim to achieve?

Accepted Answer

Limit the spread and damage of the incident

Answer

Identify the root cause of the incident

Answer

Restore systems to normal operations

Answer

Document all evidence for legal proceedings

Question 3

What is the primary goal of the eradication phase in incident response?

Accepted Answer

Remove the threat from all affected systems

Answer

Notify law enforcement of the attack

Answer

Restore backups and resume business operations

Answer

Conduct a lessons-learned review

Question 4

What is a chain of custody in digital forensics?

Accepted Answer

Documentation tracking evidence handling from collection to court presentation

Answer

The order in which malware spreads across a network

Answer

A checklist for incident response procedures

Answer

The sequence of events in a security incident

Question 5

What type of malware encrypts victim files and demands payment for the decryption key?

Accepted Answer

Ransomware

Answer

Spyware

Answer

Rootkit

Answer

Adware

Question 6

What is the purpose of a post-incident review (lessons learned)?

Accepted Answer

Analyze the incident to improve future response capabilities

Answer

Re-image all affected systems

Answer

File criminal charges against attackers

Answer

Restore data from the most recent backup