What is the first phase of the incident response lifecycle as defined by NIST SP 800-61?
Ecih Ir Lifecycle
Question · Easy
AWS or YOU?
Short
Which type of malware replicates itself across networks without requiring user interaction?
Ecih Malware Analysis
Chapter 1: Introduction to Incident Handling and Response
1.1 Information Security Fundamentals, Threat Landscapes, and Attack Vectors
Study guide
What is the primary purpose of a SIEM (Security Information and Event Management) system in incident response?
Ecih Threat Intelligence
Tech Exam Prep Podcast
Listen on Spotify
Podcast
During incident triage, what is the primary goal?
Which email header field is most useful for tracing the origin of a phishing email?
Ecih Forensics
What is the chain of custody in digital forensics?
1.2 Incident Management Principles, CSIRT Team Structures, and SOAR Automation
Which containment strategy involves isolating an affected system while keeping it powered on to preserve volatile evidence?
Question · Medium
What type of malware analysis examines the binary without executing it?
What is the purpose of a threat intelligence platform (TIP) in incident response?
Which network forensics tool captures and analyzes full packet data on a network segment?
1.3 Cyber Defense Frameworks: NIST SP 800-61, ISO 27035, MITRE ATT&CK, and Cyber Kill Chain
What is the difference between an Indicator of Compromise (IOC) and an Indicator of Attack (IOA)?
During malware analysis, what does running a sample in a sandbox environment accomplish?
What is the primary purpose of the eradication phase in incident response?
Which cloud-specific logging service would you examine when investigating a security incident in AWS?
Ecih Cloud Ir
1.4 Risk Management, Security Policies, and Security Auditing
What is the role of a Computer Security Incident Response Team (CSIRT)?
Which technique do attackers use to maintain persistence by modifying the Windows Registry Run keys?
What is the purpose of creating a forensic image of a compromised hard drive?
What is the MITRE ATT&CK tactic that encompasses techniques used by adversaries to maintain their foothold in a compromised environment?
Chapter 2: Incident Handling Process: Preparation, Detection, and Triage
2.1 Incident Response Preparation, Policies, and Playbook Design
Which insider threat indicator involves an employee accessing large volumes of sensitive data outside their normal work responsibilities?
What is the purpose of a lessons-learned meeting after an incident is resolved?
Which malware analysis technique uses API call monitoring to understand a sample's behavior during execution?
What is the shared responsibility model in cloud incident response?
2.2 Incident Recording, Categorization, and Triage Methodologies
Which volatile data should be collected first from a compromised system according to the order of volatility?
What is a Business Email Compromise (BEC) attack?
What is the purpose of YARA rules in malware analysis and incident response?
Which log source provides the most detailed information about user authentication events on a Windows domain controller?
2.3 Incident Notification, Escalation Paths, and Stakeholder Communication
What is the primary characteristic of fileless malware?
In cloud incident response, what is the first step when a compromised IAM access key is identified in AWS?
What is the Cyber Kill Chain framework?
Which incident response action involves monitoring the attacker's activity to gather intelligence before containment?
Chapter 3: Incident Handling Process: Containment, Eradication, and Post-Incident
3.1 Incident Containment Strategies, Isolation, and Evidence Protection
What is the primary purpose of DNS sinkholing in incident response?
Which type of malware encrypts a victim's files and demands payment for the decryption key?
What is the function of a SOAR (Security Orchestration, Automation, and Response) platform?
During web application incident investigation, which log file reveals details about HTTP requests including the source IP, requested URL, and status code?
3.2 Eradication Procedures, Remediation, and Secure System Recovery
What is the Pyramid of Pain in threat intelligence?
Which memory forensics tool is used to analyze RAM dumps for malware artifacts, hidden processes, and network connections?
What is a watering hole attack?
Loading more…