Incident Response

1. According to NIST SP 800-61 Rev 2, what are the four phases of the incident response lifecycle in the correct order?

A. Detection, Containment, Recovery, Preparation B. Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity C. Identification, Protection, Detection, Response, Recovery D. Preparation, Triage, Escalation, Eradication

2. A security team assembles a pre-positioned incident response kit containing forensic laptops, removable media, forensic software, and digital cameras kept ready for deployment. What is this kit called, and which NIST IR lifecycle phase does it support?

A. Evidence locker — supports the Post-Incident Activity phase for evidence preservation B. Incident go bag — supports the Preparation phase by ensuring response tools are available before an incident occurs C. Containment toolkit — supports the Containment phase by enabling rapid system isolation D. Recovery package — supports the Recovery phase for system rebuilding

3. During a malware incident, a responder isolates an infected system from the network to stop attacker communication. Immediately after isolation, the malware begins deleting critical files, destroying evidence. What specific challenge does this illustrate?

A. Alert fatigue — too many alerts prevented the responder from acting faster during containment B. Technical debt — old systems make containment difficult because they cannot be isolated cleanly C. Isolation can trigger self-destruct behavior in sophisticated malware that detects it is being contained and destroys evidence or payload to prevent analysis D. Inadequate preparation — the team lacked the correct tools to contain malware without triggering deletion

4. After confirming a successful intrusion, the incident response team identifies four tasks: (1) delete malware files; (2) disable the account used by the attacker; (3) patch the vulnerability that was exploited; (4) restore systems from clean backups. Which NIST phase do tasks 1, 2, and 3 belong to, and which does task 4 belong to?

A. Tasks 1, 2, 3 = Detection and Analysis; Task 4 = Preparation B. Tasks 1, 2, 3 = Eradication (within Containment, Eradication, and Recovery); Task 4 = Recovery (within the same phase) C. Tasks 1, 2, 3 = Post-Incident Activity; Task 4 = Containment D. All four tasks = Containment, Eradication, and Recovery

5. An incident response team holds a post-incident review meeting three weeks after an incident was resolved. Several team members no longer remember specific details about when alerts were received or which actions were taken first. What post-incident meeting guidance does NIST SP 800-61 provide that the team failed to follow?

A. The meeting should have included only senior management to protect sensitive details B. The post-incident meeting should be held as soon as possible after the incident is resolved, while participant memories are fresh and timelines can be accurately reconstructed C. NIST requires post-incident meetings to be conducted using forensic video recordings, not human recollection D. The meeting should be conducted simultaneously with the recovery phase, not after resolution

6. A security organization is evaluating two training options for its incident response team: (1) scheduled meetings where participants discuss hypothetical attack scenarios and make decisions without touching live systems; (2) realistic exercises where the technical team executes actual response procedures against a simulated attack in a test environment. What are these training methods called?

A. (1) Red team exercise; (2) Purple team exercise B. (1) Tabletop exercise; (2) Simulation C. (1) Sandbox analysis; (2) Forensic exercise D. (1) Lessons-learned review; (2) Penetration test

Matching: Incident Response Concepts

Match each concept (1–4) to its correct description (A–D).

1Sandbox

2File Integrity Monitoring (FIM)

3Critical file hash values

4Tabletop exercise

ACryptographic hashes of OS and application files prepared during the Preparation phase; used during incident analysis to determine whether critical files have been modified or replaced by malware

BAn isolated operating system environment where suspected malware can be safely executed and analyzed; reset or destroyed after analysis without affecting production systems

CA scenario-based discussion exercise where the IR team walks through a hypothetical incident and makes decisions without executing actions on live systems; low cost, suitable for management participation

DA detection tool that continuously monitors critical system files and configuration files, alerting when unauthorized changes are detected; a host-based indicator that attacker activity has modified the system

Incident Response — Quiz