DFIR-01-02-03 Quiz - First Week

Question 1

Examining and analyzing artifacts after a cyberattack?

Accepted Answer

Digital Forensics

Question 2

The most valuable business asset?

Accepted Answer

Employees

Question 3

RACI?

Accepted Answer

Responsible, Accountable, Consulted, Informed

Question 4

What is a hash?

Accepted Answer

An algorithm that calculates a one-way fixed size number

Question 5

On a Windows OS what happens when a file is deleted?

Accepted Answer

Original file untouched, file inode placed in the recycle bin

Question 6

Information that helps understand how an attacker operates to improve protection

Accepted Answer

Threat information

Question 7

Incident response requires a comprehensive methodology rather than a step-by-step set of instructions

Accepted Answer

True

Question 8

NIST IR process steps include?

Accepted Answer

Detection and Analysis, Post-incident analysis, Containment, Eradication, and Recovery, Preparation

Question 9

The CIA triad helps organizations?

Accepted Answer

Focus cybersecurity efforts toward what is most important, Measure risk, Prioritize investments, Guide the security of an environment

Question 10

The certainty that data is trustworthy and accurate (unaltered)

Accepted Answer

Integrity

Question 11

Determines which applications must always remain operational

Accepted Answer

DRP - Disaster Recovery Plan

Question 12

A backup site that's maintained with near real-time backups and can be ready for switchover within short period of time

Accepted Answer

Warm site

Question 13

A hash produces?

Accepted Answer

A fixed size number from variable sized data

Question 14

Private organization established in 1989 that offers research and education in the field of information security

Accepted Answer

SANS

Question 15

CoC Process consists of?

Accepted Answer

Filling out CoC form and keeping with evidence, Placing it in a safe place and checking it in/out on the CoC form, Proper acquisition of evidence

Question 16

What should Incident Responders do between events?

Accepted Answer

Revise incident response procedures, Seek mentorship and train for expanded roles, Work to incorporate lessons learned back into cybersecurity systems

Question 17

A backup site that may not have all the equipment or backups to restore full service and restoration may take longer

Accepted Answer

Cold site

Question 18

Keeps business operations running at another location in case of emergency or severe business impact

Accepted Answer

BCP - Business Continuity Plan

Question 19

Reviews asset discovery and vulnerability assessment data. Explores ways to identify stealthy threats?

Accepted Answer

Tier 3 Expert Security Analyst

Question 20

Metadata from a picture often contains camera model, gps, and time-date information?

Accepted Answer

True

Question 21

Average time for businesses to detect an attack?

Accepted Answer

6 months

Question 22

Guarantee of non-stop access to data

Accepted Answer

Availability

Question 23

Ensures sensitive data is accessed only by authorized individuals

Accepted Answer

Confidentiality

Question 24

Incident responder that determines and directs remediation and recovery efforts?

Accepted Answer

Tier 2 Security Analyst

Question 25

Performing containment actions when a security breach occurs?

Accepted Answer

Incident Response

Question 26

Non-regulatory federal government agency founded in 1901 that develops technology, metrics, and standards

Accepted Answer

NIST

Question 27

Threat Intelligence Process consists of

Accepted Answer

Threat intelligence distribution, Information synthesis and reporting, Team review, Threat information gathering

Question 28

DFIR process steps include?

Accepted Answer

Analyze important artifacts, Examine collected data, Collect Evidence, Report findings

Question 29

Information that is processed and analyzed to devise more effective security measures.

Accepted Answer

Threat intelligence

Question 30

What is dead analysis?

Accepted Answer

Analyzing a powered-off computer or captured evidence

Question 31

Physical items such as company vehicles, buildings, hardware, software, etc.

Accepted Answer

Tangible assets

Question 32

Who supervises the activity of the SOC team and recruits, hires, trains, and assesses the staff?

Accepted Answer

Tier 4 SOC Manager

Question 33

SANS IR process contains how many steps?

Accepted Answer

6 Steps

Question 34

A backup site thats up and running continuously and ready for immediate switchover

Accepted Answer

Hot site

Question 35

Provides proof of origin and integrity of data

Accepted Answer

Non-repudiation

Question 36

Reviews current alerts to determine relevancy and urgency for triage and prioritization?

Accepted Answer

Tier 1 Analyst

Question 37

Intellectual property, patents, trademarks, etc.

Accepted Answer

Intangible assets

Question 38

Tracks user activities during an incident

Accepted Answer

Accountability

Question 39

Threat Hunting Process consists of?

Accepted Answer

Sharing Information, Review IOCs and summarize findings in a report, Knowledge of your system and searching for IOCs

Question 40

What is live analysis?

Accepted Answer

Analyzing a powered-on system

Question 41

Incident Response is?

Accepted Answer

Triage and prioritization, Reducing damage and the cost of the recovery effort, Confronting and managing a security breach or attack

DFIR-01-02-03 Quiz - First Week

Questions 41

DFIR-01-02-03 Quiz - First Week

Questions 41