stud
bud
Sign up
Log in
Home
Library
Explore
SAT
More
DFIR 1.2 Incident Response Flashcards | StudBud
Explore
/
DFIR 1.2 Incident Response
DFIR 1.2 Incident Response
8 terms
·
StudBud Administration
·
15 plays
Imported from external platform
Flashcards
8 cards
F
Practice quiz
P
Host live
L
Questions
8
Answers
1
Which type of data can be relevant during triage?
Marketing strategies
Employee personal data
Company financial statements
Disk and memory images
2
What is the difference between a CSIRT and a SOC?
A CSIRT responds to incidents, while a SOC monitors security anomalies
A CSIRT manages finances, while a SOC handles security
A SOC is a customer service department
CSIRT and SOC are always the same team
3
What is the primary goal of incident response
Minimizing damage and recovery time
Minimizing downtime
Reducing workforce
Increasing asset protection
4
Which of the following are considered trigger for identifying a security incident?
Alerts from security tools, such as IDS and AV software
News reports about new dangers of internet usage among employees
Communication from law enforcement
Reports of unusual system behavior, such as slow performance or crashes
5
Which of the following is a critical characteristic to consider when assessing the importance of an asset in an org?
The cost of the asset
The age of the asset
The location of the asset
The fiscal value and criticality to the organization
6
In the context of a ransomware incident, what is an example of a recovery action?
Monitoring for blocked extensions
Isolating infected workstations
Creating denylists
Restoring from backup
7
What is the purpose of a RACI matrix in incident response?
To identify t he most critical threats
To catalog all organizational assets
To prioritze assets based on their value
To clarify incident management roles and responsibilites
8
What is "svchost.exe"?
A video game process that runs in the background
A Windows process used to host one or more system services; a TCP wrapper
A virus that infects Windows systems
A system file that manages startup applications
