This term refers to a security event that compromises the Confidentiality, Integrity, or Availability of an information system.

What is a forensic image?

What must you do prior to collecting forensic evidence during an incident response?

What can a forensic investigator perform periodically to safeguard the collected data against any accidental or intentional alterations during the investigation process?

Which technique can be used to provide a way to verify the authenticity and integrity of data during forensic investigations?

What is the best way a forensic investigator can validate the integrity of a physical device during an incident response?

Which Preservation technique involves making a bit-for-bit copy of an entire storage device?

Which term describes assessing an incident to understand its severity and impact on the organization?

True or False? Removing the root cause of an incident happens in the Containment phase of Incident Response.

This term describes a pre-defined, step-by-step guide for responding to specific types of incidents, and can even be automated using a SOAR solution.

BC or DR? Describes the efforts the organization takes to keep the organization running during and after a disaster event.

BC or DR? Focuses on the immediate needs of a disaster when things are the most frantic and pressing.

What is the first step in the incident response process?

These meetings must avoid pointing blame and instead focus on improving procedure.

Unusual network traffic, system anomalies, unexpected file changes, malware signatures and login anomalies are all examples of ?

Alvin received an alert from an IDS in the network, and it indicated a severity level of 1. Should he respond immediately or focus on more severe threats first, to ensure proper utilization of resources?

Which tool does a SOAR solution utilize to interact with other security tools and systems seamlessly?

A cybersecurity analyst noticed a potential network breach, so she immediately called the Incident Response team on his VoIP phone. What did she do wrong?

If a law firm wanted to ensure the preservation of digital evidence for a case, what would they likely implement?

This document shows each person who had access to the evidence, the actions they took, and the date/time that they accessed it.

This term describes the process of restoring a system to its original state by wiping it clean and installing a fresh OS, along with any applications the end user may need.

What is the purpose of Containment?

What is the last step of the digital forensics process?

What's the best option of the following tools that can be used to determine the sequence of events of an incident?

What term describes matching an incident to a specific threat actor or group?

True or False? A company recently experienced a massive data breach. The Public Relations representative did a great job at managing the fallout from the breach, showing that the company is resilient. The way it was handled will likely give the company a competitive advantage.

Choose the greatest benefit of engaging with the media to manage public perception.

True or False? New incidents should be escalated to the relevant personnel who have the authority to address it.

When dealing with GDPR customers, how many hours would a company have before they must notify them of a breach?

If criminal activity may have taken place in your organization, what should you do first?

There was a recent PHI breach that affected 750 employees. How long does the company have before they must contact the US Department of Health and Human Services (HHS)?

In the context of CySA+, MTTR stands for the following (choose 3).

Which of the following is a brief overview of a larger report?

This term describes the quantity of alerts generated by security monitoring tools.

Choose the benefit of Root Cause Analysis.