DFIR-01-02-03 Quiz - First Week

Information that is processed and analyzed to devise more effective security measures.

Incident response requires a comprehensive methodology rather than a step-by-step set of instructions

Reviews current alerts to determine relevancy and urgency for triage and prioritization?

The CIA triad helps organizations?

Intellectual property, patents, trademarks, etc.

NIST IR process steps include?

Private organization established in 1989 that offers research and education in the field of information security

Metadata from a picture often contains camera model, gps, and time-date information?

The most valuable business asset?

RACI?

Threat Intelligence Process consists of

Reviews asset discovery and vulnerability assessment data. Explores ways to identify stealthy threats?

Average time for businesses to detect an attack?

Incident Response is?

On a Windows OS what happens when a file is deleted?

Who supervises the activity of the SOC team and recruits, hires, trains, and assesses the staff?

Keeps business operations running at another location in case of emergency or severe business impact

Tracks user activities during an incident

A backup site that may not have all the equipment or backups to restore full service and restoration may take longer

Non-regulatory federal government agency founded in 1901 that develops technology, metrics, and standards

Ensures sensitive data is accessed only by authorized individuals

The certainty that data is trustworthy and accurate (unaltered)

Incident responder that determines and directs remediation and recovery efforts?

Guarantee of non-stop access to data

What is a hash?

A backup site thats up and running continuously and ready for immediate switchover

What is live analysis?

Performing containment actions when a security breach occurs?

Information that helps understand how an attacker operates to improve protection

What should Incident Responders do between events?

A backup site that's maintained with near real-time backups and can be ready for switchover within short period of time

Determines which applications must always remain operational

Threat Hunting Process consists of?

Examining and analyzing artifacts after a cyberattack?

What is dead analysis?

Physical items such as company vehicles, buildings, hardware, software, etc.

SANS IR process contains how many steps?

CoC Process consists of?

Provides proof of origin and integrity of data

DFIR process steps include?

A hash produces?