IDPS

The first phase of the NIST Incident Response Lifecycle is Preparation. What are the other phases? Select three answers.

• Containment, Eradication, and Recovery

• 
  

  Detection and Analysis

• Identify

• Post-Incident Activity

What type of process is the NIST Incident Response Lifecycle?

• Linear

• Observable

• Cyclical

• Synchronous

Fill in the blank: An _____ is an observable occurrence on a network, system, or device.

• incident

• event

• investigation

• analysis

A security professional investigates an incident. Their goal is to gain information about the 5 W's, which include what happened and why. What are the other W's? Select three answers.

• Which type of incident it was

• When the incident took place

• Where the incident took place

• Who triggered the incident

Which document outlines the procedures to follow after an organization experiences a ransomware attack?

• An incident response plan

• A security policy

• A network diagram

• A contact list

Fill in the blank: The job of  _____  is to investigate alerts and determine whether an incident has occurred.

• Public relations representative

• Incident coordinator

• Technical lead

• Security analyst

Which member of a CSIRT is responsible for tracking and managing the activities of all teams involved in the response process?

• Public relations representative

• Incident coordinator

• Technical lead

• Security analyst

Which tool collects and analyzes log data to monitor critical activities in an organization?

• Playbook

• Intrusion detection system (IDS) tool

• Intrusion prevention system (IPS) tool

• Security information and event management (SIEM) tool

Which step in the SIEM process transforms raw data to create consistent log records?

• Normalize data

• Collect and aggregate data

• Analyze data

• Centralize data

Fill in the blank: Security orchestration, automation, and response (SOAR) is a collection of applications, tools, and workflows that uses automation to _____ security events.

• respond to

• interact with

• collect

• remediate