DFIR - Phase 2 - Detection

Who is generally the first to detect a computer event and the one who must report if it escalates to something more than a system failure?

• Users

• External entities

• Help Desk or Support

• NOC - SOC

What is the purpose of incident validation in the incident response (IR) detection process?

• To preserve evidence and determine the extent of the breach

• To gather information about the incident to better understand its scope

• To confirm that an event constitutes a security breach and not a false positive

• To monitor network traffic for signs of malicious activity

What is the role of an Intrusion Detection System (IDS) in cybersecurity?

• To receive events that the help desks cannot solve

• To monitor network traffic for signs of malicious activity

• To actively hunt for and delete malware

• To resolve system failures and incidents

What is the purpose of incident scoping in cybersecurity incident response?

• To determine the extent of the breach and prioritize response activities

• To analyze event logs for signs of unusual activity

• To confirm that an event constitutes a security breach and not a false positive

• To monitor network traffic for signs of malicious activity

What is the main objective of data collection in the incident response process?

• To confirm that an event constitutes a security breach and not a false positive

• To preserve evidence, determine the extent of the breach, and identify indicators of compromise

• To actively block malicious traffic

• To resolve system failures and incidents

What is the purpose of event correlation in the incident response (IR) detection process?

• To monitor network traffic for signs of malicious activity

• To identify security incidents that would not be detected by event monitoring alone

• To gather information about the incident to better understand its scope

• To confirm that an event constitutes a security breach and not a false positive

Which of the following is NOT a common type of data that incident response teams collect during the data collection step?

• System images

• Logs

• Memory

• Employee records

What is the main purpose of the response path in cybersecurity incident response?

• To respond effectively to security breaches by involving the necessary actors

• To gather information about the incident to better understand its scope

• To identify security incidents that would not be detected by event monitoring alone

• To determine the extent of the breach and prioritize response activities

What is the purpose of educating staff to report errors in a cybersecurity incident response plan?

• To actively block malicious traffic

• To identify potential threats and treat them effectively

• To confirm that an event constitutes a security breach and not a false positive

• To gather information about the incident to better understand its scope

What is the importance of preserving evidence in cybersecurity incident response?

• To confirm that an event constitutes a security breach and not a false positive

• To actively block malicious traffic

• To gather information about the incident to better understand its scope

• To preserve evidence and determine the extent of the breach