Incident Response - Quiz 1

What is the final stage of the incident response life cycle?

• Preparation

• Eradication

• Post Incident Activity

• Detection

According to NIST SP 800-61 Rev. 2, what is defined as an incident?

• Unauthorized access to a physical location

• Unauthorized access to sensitive information

• Malicious software installation

• Violation of computer security policies

What is the goal of incident response?

• Maximize damage and disrupt operations

• Contain the incident and restore normal operations

• Minimize communication with stakeholders

• Delay the post-incident analysis

Which of the following is an example of an insider threat?

• Unauthorized access to a physical location

• Employee leaking sensitive information

• Phishing attack

• Ransomware attack

What is the first step in the incident response life cycle according to NIST SP 800-61 Rev. 2?

• Containment

• Detection

• Preparation

• Analysis

What is the purpose of forensic readiness planning?

• To carry out relevant legal procedures

• To establish a procedure for the secure storage of evidence

• To determine the source of evidence

• To identify potential evidence required for an incident

What is the role of the Security Operations Center (SOC) in incident response?

• Perform detailed investigation

• Gather intelligence about current threats

• Respond to incidents identified by the blue team

• Collect and monitor all activity of the systems

What type of incident response team is activated only if needed with the available personnel?

• Centralized IRT

• Decentralized IRT

• Temporal IRT

• Structured IRT

What is the role of a Threat Researcher in the incident response team?

• Perform detailed investigation

• Gather intelligence about current threats

• Oversee and coordinate response efforts

• Initial detection and analysis of incidents

What is the responsibility of the Legal and Compliance Officer in incident response?

• Manage internal and external communication

• Restore systems and services post-incident

• Implement technical controls

• Ensure legal compliance during response