Incident response techniques: plans, triage and evidence

Key: C

1. AA network administrator carries out technical tasks such as blocking traffic but normally lacks the authority to make business-level decisions.
2. BA security analyst investigates and recommends actions; the analyst escalates business decisions rather than making them.
3. CCorrect: The incident commander has the authority to direct resources, approve containment that affects operations, and balance security against business needs.
4. DA help desk technician handles user-facing support and ticket intake, not decisions about how the business responds to a major incident.

Key: D

1. ATesting technical security controls is the job of vulnerability scans, penetration tests or control validation, which a discussion-based tabletop exercise does not do.
2. BA tabletop exercise is a walk-through of a scenario; it does not deploy or implement any tools.
3. CPatching is a remediation activity; a tabletop changes no systems at all.
4. DCorrect: A tabletop exercise walks the team through a scenario so each person can confirm they understand their role, decision points, and communication paths.

Key: B

1. ADocumentation review only checks that the plan exists and reads correctly; it never exercises people or systems.
2. BCorrect: A full-scale simulation exercises people, processes, tools, and communications under conditions close to a real incident, so it gives the most realistic picture.
3. CStaff interviews show what people believe they would do and cannot show how they actually perform under pressure.
4. DChecklist validation confirms that steps are listed, which is the least realistic form of testing.

Key: D

1. AThe blue team defends against the simulated attack; it does not oversee both sides.
2. BThe red team plays the attacker; it is one of the participants being observed.
3. CA green team is not the neutral overseer; the term usually refers to a team that builds or improves systems based on exercise findings.
4. DCorrect: The white team acts as the neutral referee that plans the exercise, sets the rules, observes red and blue teams, and documents the results.

Key: C

1. AApproval steps are about documentation and authority; the real problem is that the rule forces an action before anyone has scoped the incident.
2. BReimaging immediately would, if anything, shorten time to respond; the real issue is lost evidence and scope.
3. CCorrect: A blanket rule to reimage at the first sign of suspicion removes analyst judgment, destroys evidence, and hides how far the compromise has spread before scope is known.
4. DLegal notification matters for some incidents, but missing it is not the main flaw of a playbook that wipes hosts before analysis.

Key: C

1. AIgnoring network logs misses exactly where Pass-the-Hash lateral movement shows up, such as NTLM authentications and SMB connections between hosts.
2. BA generic malware scan plus isolating every workstation is not specific to the technique and causes needless disruption.
3. CCorrect: A Pass-the-Hash playbook needs authentication log review (NTLM and Kerberos), credential resets, blocking lateral SMB paths, and detection tuning so the technique is caught next time.
4. DClosing the ticket right after documentation skips containment, credential resets, and detection improvements, so the attacker keeps access.

Key: A

1. ACorrect: Acting before enrichment can kill active sessions and the volatile evidence tied to them, and it signals to the attacker that they have been noticed, which may make them change tactics.
2. BDisabling an account removes access; it cannot hand the adversary administrative privileges.
3. CBreach notification duties depend on whether data was compromised, and an analyst disabling an account does not trigger them.
4. DDisabling one user account does not lock administrators out of the identity provider's console.

Key: B

1. ATime of occurrence affects staffing and response logistics, but an incident at 3 a.m. is not automatically more severe.
2. BCorrect: Priority is driven mainly by potential business impact, meaning effect on critical functions, regulated data, finances, and reputation.
3. CThe affected system matters only through its business value, which is why business impact is the better answer.
4. DTechnical complexity affects how hard the incident is to handle but has no bearing on how urgently it must be handled.

Key: A

1. ACorrect: High outbound traffic from a database holding regulated PCI data points to possible active exfiltration on a critical asset, so it carries the highest business impact.
2. BThe malware on DEV-SRV-04 was already quarantined, so the immediate threat is contained and the asset holds only internal data.
3. CFailed logins on a workstation with public data may be a brute-force attempt, but nothing shows a successful compromise.
4. DA SQL injection attempt against a public-facing server is common background noise unless there is evidence it succeeded.

Key: A

1. ACorrect: memory holds running processes, network connections and other volatile artifacts that are lost when the host is isolated or powered off, so capture it first and then isolate to stop the C2 and lateral movement.
2. BA full disk image takes a long time, and while it runs the attacker keeps moving and staging data; disk is also less volatile than memory, so it comes later.
3. CReimaging at once destroys all the evidence and leaves you blind to how far the attacker spread.
4. DRebooting wipes memory and active connections, the most volatile evidence, and does not reliably remove persistence.

Key: B

1. AFirewall logs are kept for 90 days and can wait, and rule change history alone would still miss the endpoint data that is about to age out.
2. BCorrect: The earliest EDR records of the intrusion age out in about a day, so capture the EDR telemetry now or the timeline will have a gap at its start.
3. CA weekly archive may run after the oldest EDR data has already expired, about a day from now.
4. DDisk images alone lack process, network, and memory activity, so the timeline would be incomplete.

Key: B

1. AVendor SLAs may matter for escalation, but they do not record what happened during the incident.
2. BCorrect: A detailed timeline of every action taken supports the investigation, legal proceedings, chain of custody, and the lessons-learned review.
3. CContact lists belong in the incident response plan, prepared ahead of time; they are not the record kept during the response.
4. DWarranty information has no role in documenting or investigating an incident.

Key: A

1. ACorrect: Live forensics collects evidence such as memory, running processes, and network connections from a system that must stay powered on and in service.
2. BEndpoint security is a category of protective controls instead of a method of investigating a device.
3. CHard drive imaging usually requires taking the system offline or capturing it as a static copy, which the scenario rules out.
4. DPacket analysis examines network traffic; it does not investigate the device itself.

Key: B

1. AIT and OT rarely share a uniform patch process; OT patching is often limited by vendors and uptime, so uniformity is not the challenge to plan around.
2. BCorrect: OT systems put safety and availability first and run different architectures and protocols, so the plan must handle different priorities, containment options, and recovery steps for each environment.
3. CLimited connectivity between IT and OT is often a deliberate design, and it can even slow spread; it is not the unique planning challenge.
4. DStandard firewall policies are routine network controls and do not address how IT and OT incidents must be handled differently.

Key: A

1. ACorrect: The root cause is the control failure that let the remote access account be abused, here the lack of mandatory MFA; everything after login is a consequence.
2. BPrivilege escalation is a later step in the attack chain, a symptom of the compromise rather than its cause.
3. CExecuting the payload is what the attacker did after gaining access, the proximate event that does not explain why access was possible.
4. DLateral movement is another later step in the attack chain, so it cannot be the underlying weakness.

Key: D

1. AMissing EDR affects how fast the attack was detected but does not explain why the credentials could be stolen and reused.
2. BUnpatched domain controllers are only part of the picture and ignore the credential theft and missing MFA shown in the evidence.
3. CNothing in the logs points to brute force; the evidence shows credential theft, which weak passwords alone do not explain.
4. DCorrect: The evidence ties the attack to stolen credentials that worked because MFA was not enforced, made worse by delayed patching, so that combination is the root cause.

Key: B

1. ARebooting is a recovery or troubleshooting action, and it can destroy volatile evidence; it does not uncover causes.
2. BCorrect: The 5 Whys technique asks why repeatedly, moving past symptoms to the underlying process or control failure.
3. CChanging passwords is a containment or remediation step and finds nothing about causes.
4. DTerminating a user is an HR or disciplinary action and does nothing to find what contributed to an incident.