Incident Response

During a memory analysis, which three critical points should be examined to identify potential threats?

• Process Tree

• File Fragmentation

• Network Connections

• Signature Status

Which two Windows Event IDs are important to check when monitoring user account creation and additions to security-enabled local groups?

• Event ID 4720

• Event ID 4689

• Event ID 4732

• Event ID 4270

Which security event logs would you check to monitor the creation and modification of scheduled tasks?

• Event ID 4698

• Event ID 4672

• Event ID 4220

• Eventy ID 4702

Which of the following can be used to reinfect a system even if a user removes a malicious file, as it may trigger reinstallation upon reboot?

• Services

• Run Keys

• Processes

• Multiple Users Creation

At what stage of the NIST Incident Response process are malicious activities confirmed, and decisions are made on how to respond to them?

• • Post-Incident Activity

• • Containment, Eradication & Recovery

• • 
    Detection & Analysis

• • Preparation