What is False positive?

occurs when an alert misidentifies benign activity as malicious

What is the significance of ensuring evidence of true copies of a system state at the time of the breach?

It establishes the credibility and integrity of the evidence

In digital forensics, why is the order of volatility significant during the data acquisition process?

ensures evidence from volatile sources gets collected before less sources

What is the primary risk when using the live acquisition method during a cybersecurity investigation?

It may alert the threat actor and allow time for anti-forensic actions.

In digital forensics, why is de-duplication important in e-discovery software tools?

De-duplication reduces the volume of data for analysis.

A CISO needs to highlight the primary objective of the "containment" phase. What options will they be highlighting?

Securing data and limiting the immediate impact

What concept in monitoring gives an overview of info from various data sources for daily incident response tasks?

Security Information and Event Management tools

Which analysis captures network traffic to decode packet header fields aiding in identifying attack tools & sus domains?

Wait for more alerts to confirm the incident before taking any action

What incident response steps are MOST relevant for addressing targeted data exfiltration incident? (Select two)

Containment and eradication, Analysis and lessons learned

What action should be done when there's alerterting threat actor activity on one of a networks servers?

Analyze the alert and determine if a genuine incident has occurred

What is Threat hunting?

searching for threats and indicators of compromise within a network

What is the primary objective of a containment phase?

To isolate the attack to prevent further exploitation

Why does a security team implement threat-hunting tactics?

To proactively discover evidence of threat actor activity.

An analyst confirms that an unauthorized person has accessed sensitive info. What should an incident response team do?

Disconnect servers from the network, isolating it from the environment

In investigations, why is it crucial to ensure the admissibility of digital evidence collected from computer systems?

Due process of laws require proper handling of digital evidence.

When conducting investigation, how does recording evidence process on video help to ensure the evidence integrity?

Video recording proves the evidence originated from the crime scene

What order must a CIRT follow when performing the CompTIA incident response process?

Detection, analysis, containment, eradication, recovery

What is the primary objective of a security team threat-hunting?

To isolate affected systems from the network to prevent further spread.

What steps should a CIRT take in containment of incident response to address initiation of an evasive unknown malware?

Use network segmentation to isolate and monitor infected systems

What is Alert tuning?

refining detection rules and adjusting alert parameter to enhance precision

What is a purpose of the containment during an incident response lifecycle for a user account?(Select two)

Limit the impact of incident while securing data and notifying stakeholders, Disable a user account

When conducting an investigation, why is using a memory dump to extract valuable data from a computer system?

Provide information about active processes, registry data, and more.

After containing a breach, what is a team's primary objective in the final phase of incident response?

Analyzing the incident to improve procedures or systems

What is the primary objective of a security team threat-hunting?

To discover evidence of known TTPs and indicators within the network.

What is Alert fatigue?

when inundated with multiple low-priority alerts that can lead to a breach

studbud

Lesson 12: Explain Incident Response and Monitoring Concepts

32 termsStudBud Administration

COMPTIA Sec+ 701 Lesson 12: Explain Incident Response and Monitoring Concepts

Flashcards32 cardsFPractice quizPHost liveL

Questions 32

Answers

1
What is False positive?
occurs when an alert misidentifies benign activity as malicious
refining detection rules and adjusting alert parameter to enhance precision
searching for threats and indicators of compromise within a network
when inundated with multiple low-priority alerts that can lead to a breach
2
What is the significance of ensuring evidence of true copies of a system state at the time of the breach?
It quickens recovery by restoring the system to the state before the breach
It eliminates the need for documentation in the investigation
It prevents unauthorized user access to the investigation
It establishes the credibility and integrity of the evidence
3
In digital forensics, why is the order of volatility significant during the data acquisition process?
the legality of the data seizure in progress for accurate in
the admissibility of evidence in court from the data collection
applies to physical crime scenes, for accurate investigation purposes.
ensures evidence from volatile sources gets collected before less sources
4
What is the primary risk when using the live acquisition method during a cybersecurity investigation?
It does not capture volatile memory data.
It requires physically unplugging the system, which can lead to data loss.
It may alert the threat actor and allow time for anti-forensic actions.
It will not alter data on the disk, protecting evidence integrity.
5
In digital forensics, why is de-duplication important in e-discovery software tools?
De-duplication reduces the volume of data for analysis.
De-duplication prevents tampering of stored evidence.
De-duplication ensures evidence remains confidential.
De-duplication helps investigators locate files of interest.
6
A CISO needs to highlight the primary objective of the "containment" phase. What options will they be highlighting?
Identifying indicators of threat actor activity
Restoring the affected system to a secure state
Securing data and limiting the immediate impact
Analyzing the incident and improving procedures or systems
7
What concept in monitoring gives an overview of info from various data sources for daily incident response tasks?
Host-based intrusion detection systems
Network-based vulnerability scanners
Log files generated by applications on hosts
Security Information and Event Management tools
8
Which phase of response is investigating the reported network activity to determine if a genuine incident has occurred?
Preparation
Analysis
Eradication
Containment
9
What tool can provide view of network hosts by collecting log data from sources offering better visibility into events?
Event Viewer format logging
Syslog protocol
Single pane of glass analysis
Event metadata analysis
10
Which analysis captures network traffic to decode packet header fields aiding in identifying attack tools & sus domains?
Notify the executive decision-maker to authorize actions before proceeding
Analyze the alert and determine if a genuine incident has occurred
Wait for more alerts to confirm the incident before taking any action
Immediately disconnect the affected server from the network to isolate it
11
A team is managing incident response using CompTIA's lifecycle. A team has just completed 3rd step. What's next?
Analysis
Detection
Preparation
Containment
12
What incident response steps are MOST relevant for addressing targeted data exfiltration incident? (Select two)
Containment and eradication
Preparation and response
Detection and recovery
Analysis and lessons learned
13
What action should be done when there's alerterting threat actor activity on one of a networks servers?
Notify the executive decision-maker to authorize actions before proceeding
Immediately disconnect the affected server from the network to isolate it
Wait for more alerts to confirm the incident before taking any action
Analyze the alert and determine if a genuine incident has occurred
14
What is Threat hunting?
when inundated with multiple low-priority alerts that can lead to a breach
refining detection rules and adjusting alert parameter to enhance precision
occurs when an alert misidentifies benign activity as malicious
searching for threats and indicators of compromise within a network
15
What is the primary objective of a containment phase?
To isolate the attack to prevent further exploitation
To identify the type of incident and impacted resources
To fully restore affected systems from secure backups
To analyze the threat intelligence gathered during the incident
16
Why does a security team implement threat-hunting tactics?
To respond to security incidents after they have occurred.
To recover systems and restore data from backup.
To harden systems and create incident response resources.
To proactively discover evidence of threat actor activity.
17
An analyst confirms that an unauthorized person has accessed sensitive info. What should an incident response team do?
Threat hunting to find evidence of tactics, techniques, and procedures
Restore affected systems from backups to recover and eliminate the threat
Disconnect servers from the network, isolating it from the environment
Notify enforcement authorities about the incident for immediate action
18
In investigations, why is it crucial to ensure the admissibility of digital evidence collected from computer systems?
Digital evidence is visible to the naked eye, ensuring its authenticity.
Due process of laws require proper handling of digital evidence.
Threat actors mess with digital evidence without affecting its integrity.
Location & identity of threat actors are identifiable thru digital evidence
19
When conducting investigation, how does recording evidence process on video help to ensure the evidence integrity?
Video recording ensures no one can tamper with the collected evidence.
Recording provides a physical digital data collection process of the device
Recording verifies forensic workstation's authenticity during collection
Video recording proves the evidence originated from the crime scene
20
What order must a CIRT follow when performing the CompTIA incident response process?
Detection, analysis, eradication, restoration, improvement
Isolation, analysis, restoration, eradication, improvement
Detection, analysis, containment, eradication, recovery
Preparation, analysis, isolation, containment, recovery
21
What is the primary objective of a security team threat-hunting?
To outsource incident response to third-party agencies for handling.
To discover evidence of known TTPs and indicators within the network.
To reactively respond to alerts generated by incident management systems.
To isolate affected systems from the network to prevent further spread.
22
What kind of metadata is linked with files and information like creation date, access history, and security permissions?
Social media metadata
Email header metadata
Web metadata
File metadata
23
What logs help detect any attempts made by a threat actor to attack a wireless network through disassociation events?
Access logs from switches
System logs from routers
Firewall audit logs
Access point logs
24
What steps should a CIRT take in containment of incident response to address initiation of an evasive unknown malware?
Restore affected systems from backups & apply patches to prevent attacks
Temporarily disable all accounts to prevent the further spread of malware.
Disconnect all hosts from the network and shut down communication channels
Use network segmentation to isolate and monitor infected systems
25
What is Alert tuning?
when inundated with multiple low-priority alerts that can lead to a breach
refining detection rules and adjusting alert parameter to enhance precision
occurs when an alert misidentifies benign activity as malicious
searching for threats and indicators of compromise within a network
26
What is a purpose of the containment during an incident response lifecycle for a user account?(Select two)
Limit the impact of incident while securing data and notifying stakeholders
Identify the root cause of incidents and gather evidence for legal action
Remove all traces of the incident from affected systems
Disable a user account
27
An overflowing number of low priority alerts could lead analysts to disregard critical alerts. What is happening?
Alert tuning
False positive
Alert fatigue
Threat hunting
28
When conducting an investigation, why is using a memory dump to extract valuable data from a computer system?
Recovers lost files and volatile memory from mass storage devices.
Provide a permanent record of system usage for long-term trend analysis.
Recovers lost files and volatile memory from mass storage devices.
Provide information about active processes, registry data, and more.
29
After containing a breach, what is a team's primary objective in the final phase of incident response?
Restoring the affected system to a secure state to reintegrate it
Identifying stakeholders and reporting it to relevant parties
Analyzing the incident to improve procedures or systems
Determining the root cause of the incident to eradicate it
30
Which tool assesses different facets of cloud services such as network bandwidth and VM status in a network environment?
Data loss prevention (DLP) tool
Vulnerability scanner
Application monitor
System monitor
31
What is the primary objective of a security team threat-hunting?
To isolate affected systems from the network to prevent further spread.
To discover evidence of known TTPs and indicators within the network.
To outsource incident response to third-party agencies for handling.
To reactively respond to alerts generated by incident management systems.
32
What is Alert fatigue?
searching for threats and indicators of compromise within a network
occurs when an alert misidentifies benign activity as malicious
refining detection rules and adjusting alert parameter to enhance precision
when inundated with multiple low-priority alerts that can lead to a breach

Lesson 12: Explain Incident Response and Monitoring Concepts Flashcards | StudBud