DFIR Incidents and Containment

What is the primary goal of containment in the Incident Response lifecycle?

• To immediately eradicate all threats from the network

• To prevent the spread of a security threat and limit the damage

• To fully recover all lost or compromised data

• To identify the attacker and their methods

Limiting the ability of threat actors is crucial during containment. Which of the following actions best represents this approach?

• Installing antivirus software on all devices

• Regularly updating security policies and training

• Changing passwords and user permissions

• All of the above

'Isolation' and 'Quarantine' are both containment methods. How do they differ?

• Isolation refers to separating affected systems, while Quarantine limits the functionality of suspect files

• Quarantine refers to network-wide restrictions, whereas Isolation targets individual devices

• There is no difference; the terms are interchangeable

• Isolation is a preventive measure, while Quarantine is a reactive measure

Restricting access is a fundamental containment method. Which of the following is a practical example of this method?

• Implementing a firewall

• Disabling unused accounts and services

• Running a malware scan

• Updating software regularly

Patching is critical for containment. What does it primarily involve?

• Monitoring network traffic for suspicious activity

• Updating software to fix security vulnerabilities

• Separating parts of the network to prevent spread of threats

• Limiting user access to sensitive information

Network Segmentation plays a key role in containment. Which statement best describes its purpose?

• To enhance the performance of network traffic

• To create distinct security zones for different types of information

• To reduce the cost of network management

• To eliminate the need for firewalls and other security measures

Continuous monitoring is essential during the containment phase. What is its primary purpose?

• To ensure that all employees are following security policies

• To keep an updated inventory of all hardware devices

• To detect and respond to any anomalies or further signs of compromise

• To reduce the amount of data stored on the network

An attacker has been calling employees pretending to be from the IT department, convincing them to reveal their login credentials. Which term best describes this incident?

• Password Attack

• Physical Security Breach

• Social Engineering

• Unpatched Vulnerabilities

A company has neglected to apply the latest security patches to its systems, leading to an exploitation of these known weaknesses. What does this scenario exemplify?

• Password Attack

• Physical Security Breach

• Denial of Service (DoS)

• Unpatched Vulnerabilities

An organization's customer data has been accessed without authorization and has been potentially exposed. What type of incident does this describe?

• Insider Threat

• Ransomware Attack

• Malware Infection

• Data Breach