7.0 Security Operations
Incident Response & Forensics Practice Questions
Incident response phases, digital forensics, order of volatility, chain of custody, and evidence types.
One solved question, so you can see how these are marked
A SIEM alert indicates that a privileged account authenticated from two distant countries within five minutes. What is the BEST first action for the incident manager?
Validate and scope the alert with authentication, endpoint, and network data.
Detection and analysis should first validate the suspected incident and determine its scope and impact so that response actions are proportionate. Disabling all accounts, public notification, or rebuilding a system before analysis may disrupt operations, destroy evidence, or be premature.
Every question in the set below is marked like this. The answers stay hidden until you pick one.
All 9 Incident Response & Forensics questions in this set
Answers and explanations appear when you work through the set above.
During an active compromise, which data should a forensic analyst generally acquire before a disk image because it is more volatile?
- Live connections and login sessions
- Archived backup tapes
- Files in a long-term document repository
- Printed incident reports
A ransomware infection is spreading between production servers. Which action BEST represents mitigation during the initial response?
- Publish the final incident report to all employees.
- Conduct a quarterly review of security awareness training.
- Perform a root cause analysis after all systems are restored.
- Isolate affected segments while preserving essential operations.
A company may need to present a collected laptop image in court. Which practice MOST strengthens the evidence's integrity and admissibility?
- Let several analysts examine and modify the original image to accelerate the investigation.
- Chain-of-custody records of identifiers, handlers, times, locations, transfers, and hashes.
- Copy the image to removable media without recording who performed the copy.
- Wait for the investigation to finish, then reconstruct the chain of custody from analyst recollections and help desk tickets.
Which statement BEST distinguishes a forensic duplicate from an ordinary file copy?
- A verified bit-for-bit acquisition that can include unallocated space.
- A selection of user-visible documents copied by an administrator without recording unused storage areas.
- A forensic duplicate is always created after the original device is reformatted.
- A forensic duplicate is valid only when it is stored on the suspect's computer.
Legal counsel issues a litigation hold after discovering that an intrusion may have caused a contract dispute. What is the hold primarily intended to do?
- Authorize investigators to search any personal device without restrictions.
- Replace the organization's incident response plan.
- Guarantee that every collected artifact will be admitted in court.
- Preserve potentially relevant electronic information from alteration or deletion.
After restoring a compromised application, the security manager wants to prevent recurrence. Which activity BEST addresses remediation?
- Close the incident after restoring availability and retain the existing configuration as the known operational baseline.
- Send an informal message asking users to be more careful.
- Fix and verify the exploited weakness, then update related procedures or configurations.
- Delete all investigation notes to reduce legal exposure.
In a post-incident review, the team asks why a stolen service credential was accepted from an unmanaged host. Which approach BEST supports root cause analysis?
- Assign blame to the analyst who first reported the alert.
- Trace identity, endpoint, and access-control conditions to a controllable systemic cause.
- Measure only the number of alerts generated by the SIEM.
- Record the attacker's use of the stolen credential as the complete root cause without examining device trust policy.
Which item is MOST appropriate for an executive incident report after containment and recovery?
- All captured raw packets and endpoint traces, organized by capture tool rather than business impact
- Unverified theories about the attacker's identity and motives, without confidence levels
- An unfiltered list of analyst keystrokes and tool commands without any business context
- Impact, timeline, actions, notifications, residual risk, and improvements
What is the BEST outcome of a lessons-learned review conducted after an incident?
- Prioritized policy, control, training, and response improvements with owners and follow-up measures
- A policy to stop recording embarrassing incidents and to remove historical reports from management review materials
- A permanent suspension of all similar business services
- A replacement of evidence with a verbal summary