NEW
Font size
WorksheetsChapter 10: Incident Detection and Analysis
Total questions: 20
Worksheet time: 20mins
Susan needs to track evidence that has been obtained throughout its life cycle. What documentation does she need to create and maintain if she expects the evidence to be used in a legal case?
Forensic hashes
Legal hold
Chain of custody
IoC ratings
Hui wants to comply with a legal hold but knows that her organization has a regular process that purges logs after 45 days due to space limitations. What should she do if the logs are covered by the legal hold?
Notify counsel that the logs will be deleted automatically in 45 days.
Delete the logs now to allow longer before space is filled up.
Identify a preservation method to comply with the hold.
Make no changes; holds allow ongoing processes to continue as normal.
Juan wants to validate the integrity of a drive that he has forensically imaged as part of an incident response process. Which of the options should he select?
Compare a hash of the original drive to the drive image.
Compare the file size on disk of the original drive to the space taken up by the drive image.
Compare the vendor's drive size listing to the space taken up by the drive image.
Use PGP to encrypt the drive and image and make sure that both encrypted versions match.
Kathleen wants to determine if the traffic she is seeing is unusual for her network. Which of the following options would be most useful to determine if traffic levels are not typical for this time of day in a normal week?
Heuristics
Baselines
Protocol analysis
Network flow logs
Renee wants to adopt an open IoC feed. What issue is Renee most likely to need to address when adopting it?
The cost of the IoC feed
The quality of the feed
The update frequency of the feed
The level of detail in the feed
Chris wants to use an active monitoring approach to test his network. Which of the following techniques is appropriate?
Collecting NetFlow data
Using a protocol analyzer
Pinging remote systems
Enabling SNMP
Which of the following is not information commonly found in an IoC?
IP addresses
Domain names
System images
Behavior-based information
Cameron wants to be able to detect a denial-of-service attack against his web server. Which of the following tools should he avoid?
Log analysis
Flow monitoring
iPerf
IPS
Sameer finds log information that indicates that a process that he believes is malicious starts at the same time every day on a Linux system. Where should he start looking for an issue like this?
He should review the system log.
He should check the Task Scheduler.
He should check cron jobs.
He should check user directories.
Jim uses an IoC feed to help detect new attacks against his organization. What should he do first if his security monitoring system flags a match for an IoC?
Shut down the system that caused the alert
Review the alert to determine why it occurred
Check network logs to identify the remote attacker
Run a port scan to determine if the system is compromised
While monitoring network traffic to his web server cluster, Mark notices a significant increase in traffic. He checks the source addresses for inbound traffic and finds that the traffic is coming from many different systems all over the world. What should Mark identify this as if he believes that it may be an attack?
A denial-of-service attack
A distributed network scan
A DNS-based attack
A distributed denial-of-service attack
Valentine wants to check for unauthorized access to a system. What two log types are most likely to contain this information?
Authentication logs and user creation logs
System logs and application logs
Authentication logs and application logs
System logs and authentication logs
Sayed notices that a remote system has attempted to log into a system he is responsible for multiple times using the same administrator's user ID but different passwords. What has Sayed most likely discovered?
A user who forgot their password
A broken application
A brute-force attack
A misconfigured service
While Susan is monitoring a router via network flows, she sees a sudden drop in network traffic levels to zero, and the traffic chart shows a flat line. What has likely happened?
The sampling rate is set incorrectly.
The router is using SNMP.
The monitored link failed.
A DDoS attack is occurring.
Leo wants to monitor his application for common issues. Which of the following is not a typical method of monitoring for application issues?
Up/down logging
System logging
Performance logging
Transactional logging
Greg notices that a user account on a Linux server he is responsible for has connected to 10 machines via SSH within seconds. What type of IoC best matches this type of behavior?
Bot-like behavior
Port scanning
Denial of service
Escalation of privileges
Arun wants to monitor for unusual database usage. Which of the following is most likely to be indicative of a malicious actor?
Increases in cached hits to the database
Decreases in network traffic to the database
Increases in disk reads for the database
Decreases in database size
Valerie is concerned that an attacker may have gained access to a system in her datacenter. Which of the following behaviors is not a common network-based IoC that she should monitor for?
Traffic to unexpected destinations
Unusual volumes of outbound traffic
Increases in system memory consumption
Outbound traffic at unusual times
Alex has noticed that the primary disk for his Windows server is quickly filling up. What should he do to determine what is filling up the drive?
Check the filesystem logs.
Check the security logs.
Search for large files and directories.
Search for file changes.
Joseph wants to be notified if user behaviors vary from normal on systems he maintains. He uses a tool to capture and analyze a week of user behavior and uses that to determine if unusual behavior occurs. What is this practice called?
Pattern matching
Baselining
Fingerprinting
User modeling
