Why is alert tuning important for a SIEM system?

To reduce false positives and improve detection accuracy

During a cybercrime investigation, which data should be acquired first to preserve volatility?

RAM contents and active network connections

A company experiences a breach where self-replicating malware spreads on the network and gains higher privileges on PCs

Worms performing privilege escalation

During an active security incident, how can segmentation-based containment help mitigate the threat?

Isolating affected systems to prevent lateral movement

What is the primary objective of the detection phase in the incident response cycle?

Identify potential security threats and anomalous activity

Which of the following best describes how metadata is generated for users in an IT environment?

Automatically created through user activities, such as file creation

During a forensic investigation, what best describes latent evidence in IT?

Hidden evidence requiring specialized tools to uncover

studbud

Cybersecurity Incident Response

10 termsStudBud Administration27 plays

Explore the incident response process, detection phase, containment strategies, forensic investigation, and more in this engaging quiz on cybersecurity incident response.

Flashcards10 cardsFPractice quizPHost liveL

Questions 10

Answers

1
Why is alert tuning important for a SIEM system?
To remove correlation rules from the system
To reduce false positives and improve detection accuracy
To increase the number of alerts for all events
To disable low-priority alerts permanently
2
During a cybercrime investigation, which data should be acquired first to preserve volatility?
Printed security logs
Backups stored on external media
Hard drive storage and archived logs
RAM contents and active network connections
3
A user is tricked into clicking a link that performs an action on a website where they are already logged in.
CSRF
CSRF
CSRF
CSRF
4
A company experiences a breach where self-replicating malware spreads on the network and gains higher privileges on PCs
Rootkits hiding system processes
Trojan executing remote commands
Ransomware encrypting user files
Worms performing privilege escalation
5
During an active security incident, how can segmentation-based containment help mitigate the threat?
Isolating affected systems to prevent lateral movement
Blocking all external traffic to the network
Removing all infected devices immediately without analysis
Completely shutting down all network access
6
Analysis reveals malware is embedded deep within a system, masking its presence and resisting standard removal methods.
Ransomware encrypting files
Rootkits avoiding removal
Adware displaying unwanted pop-ups
Keylogger stealing credentials
7
What is the primary objective of the detection phase in the incident response cycle?
Notify law enforcement before confirming the incident
Restore affected systems immediately
Identify potential security threats and anomalous activity
Eradicate the threat before analyzing it
8
An employee reports that they can no longer access their files and a message appears demanding payment in cryptocurrency
Worm
Cryptoransomware
Spyware
Trojan
9
Which of the following best describes how metadata is generated for users in an IT environment?
Automatically created through user activities, such as file creation
It is exclusively created by third-party monitoring tools
Metadata is only generated when a system administrator assigns it
Users manually enter metadata for tracking purposes
10
During a forensic investigation, what best describes latent evidence in IT?
Physical documents containing login credentials
Hidden evidence requiring specialized tools to uncover
Logs that are automatically deleted after a system reboot
Evidence that is immediately visible and accessible

Cybersecurity Incident Response Flashcards | StudBud