stud
bud
Sign up
Log in
Home
Library
Explore
SAT
More
IR101 Flashcards | StudBud
Explore
/
IR101
IR101
20 terms
·
StudBud Administration
·
45 plays
Imported from external platform
Flashcards
20 cards
F
Practice quiz
P
Host live
L
Questions
20
Answers
1
What is the first phase of the incident response lifecycle according to NIST?
Preparation
Containment
Recovery
Detection and Analysis
2
An incident response plan is not necessary if you have antivirus protection.
False
True
3
Which tool is commonly used to analyze network traffic during an incident?
Nmap
Nessus
Metasploit
Wireshark
4
Indicators of Compromise (IOCs) can include IP addresses, file hashes, and domain names.
False
True
5
What should be done before eradicating a threat from a system?
Restart the system
Disconnect the user
Collect and preserve evidence
Notify legal
6
Containment is always more important than preserving evidence.
False
True
7
What is a predefined action or procedure followed during an incident called?
Playbook
Protocol
Drill
Operation
8
What type of logs help track user activity on a system during an incident?
DNS logs
Threat feeds
Audit logs
Flow logs
9
Your firewall logs show repeated login attempts from a foreign IP. What type of attack might this be?
Man-in-the-middle
SQL Injection
DDoS
Brute force
10
A user’s machine is infected with ransomware. What’s your first step?
Immediately isolate the system from the network
Inform the user to pay the ransom
Delete all infected files
Shut down the system
11
Logs from firewalls and endpoints are useful in identifying the timeline of an incident.
False
True
12
A phishing email was reported by a user. What do you do next?
Delete the email and move on
inform the CISO
Mark the email as spam
Analyze the email headers and check for other recipients
13
Which of the following best describes an incident in cybersecurity?
A violation or imminent threat of violation of computer security poli
A scheduled backup failure
A routine network scan
Any observed occurrence in a system
14
What kind of testing helps validate an incident response plan?
Patch testing
Load testing
Tabletop exercise
Penetration testing
15
During analysis, you find a malicious PowerShell script. What should you do?
Copy and paste it into Notepad++ and execute it
Delete it from the system
Email it to your personal address for later study
Save it, hash it, and upload it to VirusTotal for further analysis
16
A junior analyst should always immediately delete malware found on a system
True
False
17
What is the final phase of the incident response process?
Preparation
Detection
Containment
Recovery
18
What term refers to the time between compromise and detection?
Exposure span
Log gap
Dwell time
Incident window
19
What’s the main goal of the containment phase?
To identify the attacker
To collect evidence for prosecution
To remove the malicious actor immediately
To limit the damage and prevent further spread
20
You detect a suspicious outbound connection from a critical server. What is your first action?
Notify/ report to the incident response team
Reboot the server
Block the IP address
Run a full vulnerability scan
