Incident Respond Quiz

What are the stages in the NIST Incident Response Framework?

• Preparation, Detection, Containment, Eradication, Recovery, Lessons Learned

• Planning, Execution, Monitoring, Closure

• Identification, Analysis, Mitigation, Reporting

• Initiation, Development, Implementation, Evaluation

Answer explanation

The NIST Incident Response Framework consists of six stages: Preparation, Detection, Containment, Eradication, Recovery, and Lessons Learned. This structured approach helps organizations effectively manage and respond to incidents.

What is business continuity planning?

• A strategy to ensure critical business functions continue during a disaster

• A plan to increase business profits

• A method to improve employee productivity

• A technique for market expansion

Answer explanation

Business continuity planning is a strategy to ensure that critical business functions can continue during a disaster, making it essential for organizational resilience. The other options do not address this specific need.

What is the function of a Security Operations Center (SOC)?

• To manage the organization's finances

• To serve as the operational base for CSIRT

• To develop new software

• To conduct market research

Answer explanation

The Security Operations Center (SOC) serves as the operational base for the Computer Security Incident Response Team (CSIRT), coordinating responses to security incidents and ensuring effective threat management.

What is one of the tasks of Security Analysts?

• Approving the incident response plan

• Coordinating activity during an incident

• Reviewing alerts and identifying possible incidents

• Developing new security protocols

Answer explanation

One of the key tasks of Security Analysts is reviewing alerts and identifying possible incidents. This involves monitoring security systems to detect potential threats and ensuring timely responses.

What is the role of public relations in a CSIRT?

• Developing software

• Providing contextual threat information

• Managing communication with the public

• Conducting security audits

Answer explanation

Public relations in a CSIRT focuses on managing communication with the public, ensuring clear and effective messaging during incidents. This role is crucial for maintaining trust and transparency with stakeholders.

Which of the following is NOT a source of information for Threat Researchers?

• Web

• Threat intelligence feeds

• Data from security tools

• Financial statements

Answer explanation

Financial statements are primarily used for assessing a company's financial health, not for threat research. In contrast, the web, threat intelligence feeds, and data from security tools provide relevant insights for threat researchers.

What is the first step in the NIST Incident Response Life Cycle?

• Detection & Analysis

• Preparation

• Containment, Eradication & Recovery

• Post-Incident Activity

Answer explanation

The first step in the NIST Incident Response Life Cycle is 'Preparation'. This phase involves establishing and training the incident response team, as well as developing policies and procedures to effectively handle incidents.

What is the final step in the NIST Incident Response Life Cycle?

• Preparation

• Detection & Analysis

• Containment, Eradication & Recovery

• Post-Incident Activity

Answer explanation

The final step in the NIST Incident Response Life Cycle is Post-Incident Activity. This phase involves reviewing the incident to improve future response efforts and ensure lessons learned are documented.

What should be compiled to identify critical IT assets?

• A list of software applications

• A list of IT assets such as networks, servers, and endpoints

• A list of user accounts

• A list of financial records

Answer explanation

To identify critical IT assets, it's essential to compile a list of IT assets such as networks, servers, and endpoints. This provides a comprehensive view of the infrastructure that supports business operations.

What types of inventories should be conducted according to the preparation stage?

• Only software

• Only hardware

• Both hardware and software

• Neither hardware nor software

Answer explanation

Both hardware and software inventories are essential in the preparation stage to ensure all resources are accounted for and properly managed, facilitating a smooth operational process.