Who, What, When, Where, Why

This tool will ensure that drives connected to a forensic system or device cannot be written to.

What is the role of a stakeholder in an incident response process?

What eradication/recovery process will eliminate forensic artifacts and in most cases will make it difficult to recover?

The goal of this process is to ensure that the copy exactly matches the source drive or device.

Which of the following is not typically found in a cybersecurity incident report?

Which tool is not commonly used to generate the hash of a forensic copy?

Bob's organization has been informed that data must be preserved due to pending legal action. What requirement is this?

Which of the following is not information not commonly found in an IoC?

This is used to identify why a problem, incident, or issue occured.

IoCs can help security analysts detect potential cyber threats before they occur.

Which of the following pieces of information is most critical to conducting a solid incident recovery effort?

When communicating with the media after a security incident, what should organizations do?

Which of the following is the most important factor when declaring an incident?

SOAR primarily helps organizations by:

What is the primary function of regulatory reporting in incident response?

Which one of the phases of incident response involves primarily active undertakings designed to limit the damage?

Which of the following is NOT a best practice for evidence collection in an incident response investigation?

Linda reviewed a log that lists each time a forensic image is handled. She found missing info. What does this violate?

Which stakeholder is typically responsible for handling public relations during a security incident?

What should be clearly identified during a review in order to reduce the likelihood of a similar incident in the future?