Security Incident Management

What is the FIRST step in Security Incident Handling?

• Containment

• Monitoring & Detection

• Eradication

• Post-Incident Review

Which is NOT a recommended containment measure?

• Rebooting all systems immediately

• Blocking malicious IP addresses

• Isolating infected machines & user accounts

• Changing passwords of compromised accounts

What is the PRIMARY goal of the "Eradication" phase?

• Reboot all systems

• Inform clients that a breach has occurred

• Remove the malware

• Remove all security threats & backdoors

Which team is MOST LIKELY to respond first to a security incident?

• NSOC

• HR

• Marketing

• HOO

What should ALWAYS be done after recovering from an incident?

• Patch vulnerabilities

• Monitor for re-infection

• Perform a post-incident review

• All of the above

What is the purpose of Incident IO in our incident response process?

• Monitors server temperatures

• Detects malware and removes it

• Automates incident alerting & tracking

• Encrypts sensitive files for security

In which situation should a security incident be reported to regulatory bodies?

• If a minor server restart fails

• If customer data is exposed

• If IT staff accidentally deletes a non-critical file

• If an employee loses their access badge

What is a common mistake made during the containment phase?

• Isolating only affected machines

• Blocking malicious activity

• Not preserving logs and forensic evidence

• Alerting the entire company immediately

This is the elapsed time between the start of the incident and the detection of it.

• MTTR

• MTTRP

• MTTD

• None of the above

Which workflow command should you run to declare security incident?

• /securityhelp

• /incident

• /securityincident

• /newsystem