SOC Team Responsibilities Quiz

What is the initial phase in the Incident Response Lifecycle?

• Detection and Analysis

• Preparation and Planning

• Containment, Eradication, and Recovery

• Post-Incident Activity

What is the primary objective of the Containment phase in incident response?

• Eliminate the threat vector from the environment

• Restrict the impact and propagation of the incident

• Recover compromised systems and restore data integrity

• Implement governance frameworks and operational protocols

During which phase are vulnerabilities and threats systematically eradicated from the information system?

• Eradication

• Recovery

• Detection

• Post-Incident Analysis

What is the primary objective of the Preparation phase in incident response?

• Establish governance frameworks and procedural protocols

• Mitigate vulnerabilities and eliminate threats from the environment

• Recover compromised systems and restore data integrity

• Conduct post-incident analysis to enhance security posture

Which phase is primarily concerned with the restoration of compromised systems and data integrity?

• Detection

• Recovery

• Containment

• Eradication

What is the final phase in the Incident Response Lifecycle?

• Eradication of Threats

• Post-Incident Analysis

• System Recovery

• Incident Detection

What is the fifth phase in the Incident Response Lifecycle, which focuses on the evaluation and documentation of the incident response process?

• Post-Incident Analysis

• System Restoration

• Incident Detection

• Incident Containment

Which of the following is NOT a recognized log source as delineated in the accompanying architecture diagram?

• Application Logs

• Network Infrastructure Devices

• Mobile Endpoint Devices

• Operating System Logs

Which of the following represents a log source pertinent to network devices?

• macOS

• Intrusion Prevention Systems (IPS)

• Web Application Firewalls (WAF)

• Windows

Which of the following is NOT classified as a type of network device log utilized for monitoring and troubleshooting network performance?

• Switch event logs

• Router syslogs

• Firewall audit logs

• Web server access logs