Incident Response Process CSA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An analyst is reconstructing the timeline of a breach. The analyst has the following logs: firewall logs showing outbound connections to a suspicious IP, DNS logs showing queries to a malicious domain, and Windows event logs showing a user login at 2:00 AM. Which sequence of events would BEST support the hypothesis that the breach started with a phishing email?

   • ADNS query first, then email received, then firewall connection, then user login
   • BUser login first, then email received, then DNS query, then firewall connection
   • CEmail gateway log showing the phishing email received, then user login, then DNS query, then firewall connection
   • DFirewall connection first, then DNS query, then user login, then email received
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An analyst is acquiring a forensic image of a USB drive that was used by a suspected insider. The analyst wants to ensure the image is admissible in court. Which step is most important?

   • ACopy the files to a folder on the analyst's workstation.
   • BUse a write-blocker and compute a cryptographic hash of the original drive and the image.
   • CFormat the USB drive to ensure it is clean before imaging.
   • DUse the operating system's copy command to duplicate the drive.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which containment strategy is most appropriate for a malware infection that is actively spreading across the network?

   • AIsolating the affected systems from the network
   • BRebuilding the affected systems immediately
   • CIncreasing the logging level on the affected systems
   • DDeleting the malware files from the affected systems
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company has suffered a malware infection that has been contained. The malware is known to have created a scheduled task for persistence. Which step is part of the ERADICATION phase?

   • AConducting a post-incident review
   • BDisconnecting the infected system from the network
   • CRemoving the scheduled task and deleting the malware files
   • DRestoring the system from a clean backup
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A SOC analyst is reconstructing the timeline of a security incident. The analyst has firewall logs, Windows Event Logs, and web proxy logs. Which approach best helps to reconstruct the incident timeline?

   • ACorrelate events across all log sources by timestamp and common indicators such as IP addresses and usernames.
   • BUse the Windows Event Logs exclusively because they record all system activity.
   • CAnalyze only the firewall logs because they contain all external connections.
   • DFocus on the web proxy logs because they show all user activity.
   Reveal Solution Discussion Select an answer first