Chapter 14: Monitoring and Incident Response

The following figure shows the Security+ incident response cycle. What item is missing?

• Planning

• Reporting

• Monitoring

• Preparation

Answer explanation

Key Phrase: "incident response cycle"

Explanation:
Correct Answer (D): Preparation is the first phase of the incident response cycle and involves setting up the proper tools, training the response team, and creating incident response plans.
Why others are wrong:
A: Planning is an element of preparation but not a distinct phase of the incident response cycle.
B: Reporting occurs during the response phase but is not a phase in itself.
C: Monitoring is important in incident detection but comes after preparation in the cycle.

Michael analyzes network traffic, including packet content, as part of his incident response process. What tool should he use?

• Syslog

• NetFlow

• Packet capture

• SIEM

Answer explanation

Key Phrase: "analyzes network traffic, including packet content"

Explanation:
Correct Answer (C): Packet capture tools like Wireshark allow for the detailed inspection of network packets, including their content, which is what Michael needs to do.
Why others are wrong:
A: Syslog is used for log aggregation and does not capture packet content.
B: NetFlow provides traffic flow data, not detailed packet analysis.
D: SIEM aggregates logs and event data, but it doesn't capture raw packet content.

Susan wants to create a dashboard that shows her aggregated log events related to logins from different geographic regions. Her goal is to identify impossible travel scenarios. Which of the following solutions should she select to accomplish that goal?

• IPS

• OS logs

• SIEM

• Vulnerability scan data

Answer explanation

Key Phrase: "aggregated log events related to logins from different geographic regions"

Explanation:
Correct Answer (C): SIEM systems can aggregate and correlate logs from various sources, including login events and geographic data, to detect impossible travel patterns.
Why others are wrong:
A: IPS detects network threats but is not designed to analyze user login patterns.
B: OS logs can be helpful but would need to be aggregated manually.
D: Vulnerability scan data identifies system vulnerabilities, not login events.

Selah wants to ensure that users in her organization can only install applications that are evaluated and approved by the organization's security team. What should she use?

• SIEM

• An application denylist

• An application allowlist

• sFlow

Answer explanation

Key Phrase: "only install applications that are evaluated and approved"

Explanation:
Correct Answer (C): An application allowlist only allows approved applications to run on systems, ensuring that users cannot install unapproved software.
Why others are wrong:
A: SIEM is used for log aggregation and event correlation, not application control.
B: An application denylist blocks known malicious apps but does not restrict users from installing other unapproved software.
D: sFlow is used for network monitoring, not application control.

What is the primary concern with sFlow in a large, busy network?

• It may allow buffer overflow attacks against the collector host.

• sFlow is not designed for large or complex networks.

• sFlow puts extreme load on the flow collector host.

• sFlow samples only network traffic, meaning that some detail will be lost.

Answer explanation

Key Phrase: "primary concern with sFlow"

Explanation:
Correct Answer (D): sFlow is a sampling protocol, meaning it only captures a subset of network traffic, which can result in some data being missed in high-traffic environments.
Why others are wrong:
A: Buffer overflow attacks are not a typical concern with sFlow.
B: sFlow is designed for large networks and can handle complexity, though it sacrifices some data detail.
C: sFlow doesn't typically create significant load on the flow collector.

Mark unplugs the network connection from a system that is part of an incident and places tape over its Ethernet jack with a sign that says, “Do not reconnect without approval from the IR team.” How is this method best described?

• Containment

• Isolation

• Segmentation

• Zoning

Answer explanation

Key Phrase: "removes from network and prevents reconnection"

Explanation:
Correct Answer (B): Isolation involves removing a compromised system from the network to prevent it from spreading or communicating with other systems.
Why others are wrong:
A: Containment would involve restricting a system’s activity but not necessarily removing it from the network entirely.
C: Segmentation involves dividing a network into smaller segments, typically to improve security.
D: Zoning is a similar concept but typically refers to physical network or system zones rather than incident response actions.

The company that Ben works for wants to test its incident response plan. Ben gathers the incident response team in a room and walks through a scenario to validate the organization's processes and procedures. What type of event has Ben hosted?

• A checklist exercise

• A simulation

• A tabletop exercise

• A fail-over exercise

Answer explanation

Key Phrase: "walks through a scenario to validate processes"

Explanation:
Correct Answer (C): A tabletop exercise is a scenario-based discussion that helps teams review their response strategies in a simulated environment.
Why others are wrong:
A: A checklist exercise is more structured and focused on following a list of steps.
B: A simulation involves a more hands-on approach to re-create a real incident.
D: A fail-over exercise involves testing system redundancy, not incident response plans.

Madhuri wants to check a PNG-formatted photo for GPS coordinates. Where can she find that information if it exists in the photo?

• In the location.txt file appended to the PNG

• On the original camera

• In the photo's metadata

• In the photo as a steganographically embedded data field

Answer explanation

Key Phrase: "GPS coordinates in a PNG photo"

Explanation:
Correct Answer (C): Metadata in the PNG image, such as EXIF data, often contains GPS coordinates if the photo was taken with a GPS-enabled device.
Why others are wrong:
A: Location.txt is not a standard file associated with PNG images.
B: The original camera may have stored GPS data, but it's not part of the PNG file itself.
D: Steganographically embedded data is used for hiding information, not for storing standard GPS data.

Alyssa has identified malware on a system. She removes the system from the network to ensure that it cannot impact other systems. What technique has she used to deal with this system?

• Quarantine

• Segmentation

• Converted it to agentless

• Denylisting

Answer explanation

Key Phrase: "removes from the network to prevent impact"

Explanation:
Correct Answer (A): Quarantine involves isolating the compromised system to prevent further damage or spread of malware while an investigation occurs.
Why others are wrong:
B: Segmentation refers to dividing networks into zones and doesn't necessarily involve removing a compromised system.
C: Converted it to agentless is not relevant to malware containment.
D: Denylisting involves blocking specific malicious applications but doesn't describe isolating a system.

Kristen discovers missing logs as part of her threat hunting activities. What has most likely happened?

• The logs hit the end of their lifecycle and were rotated.

• The system is a newly deployed system.

• An attacker wiped the logs to hide evidence.

• An attacker encrypted the logs as part of their process.

Answer explanation

Key Phrase: "missing logs during threat hunting"

Explanation:
Correct Answer (C): Wiping logs is a common tactic used by attackers to cover their tracks and avoid detection.
Why others are wrong:
A: Log rotation may cause logs to be archived or deleted but not usually wiped.
B: A newly deployed system would still have logs, though they might not be comprehensive.
D: Encrypting logs would not delete them but may prevent access.