DFIR-01-02-03 Quiz - First Week

Determines which applications must always remain operational

Non-regulatory federal government agency founded in 1901 that develops technology, metrics, and standards

The most valuable business asset?

The certainty that data is trustworthy and accurate (unaltered)

Threat Intelligence Process consists of

Incident responder that determines and directs remediation and recovery efforts?

RACI?

A backup site that may not have all the equipment or backups to restore full service and restoration may take longer

Information that helps understand how an attacker operates to improve protection

On a Windows OS what happens when a file is deleted?

Private organization established in 1989 that offers research and education in the field of information security

Incident response requires a comprehensive methodology rather than a step-by-step set of instructions

Performing containment actions when a security breach occurs?

The CIA triad helps organizations?

Who supervises the activity of the SOC team and recruits, hires, trains, and assesses the staff?

CoC Process consists of?

Keeps business operations running at another location in case of emergency or severe business impact

Guarantee of non-stop access to data

Threat Hunting Process consists of?

Intellectual property, patents, trademarks, etc.

Ensures sensitive data is accessed only by authorized individuals

What is a hash?

SANS IR process contains how many steps?

What should Incident Responders do between events?

Examining and analyzing artifacts after a cyberattack?

Metadata from a picture often contains camera model, gps, and time-date information?

What is dead analysis?

Reviews current alerts to determine relevancy and urgency for triage and prioritization?

Tracks user activities during an incident

A backup site thats up and running continuously and ready for immediate switchover

Reviews asset discovery and vulnerability assessment data. Explores ways to identify stealthy threats?

What is live analysis?

NIST IR process steps include?

A backup site that's maintained with near real-time backups and can be ready for switchover within short period of time

Incident Response is?

Average time for businesses to detect an attack?

Provides proof of origin and integrity of data

Physical items such as company vehicles, buildings, hardware, software, etc.

DFIR process steps include?

Information that is processed and analyzed to devise more effective security measures.

A hash produces?