Explanation:According to NIST SP 800-61, the standard incident response lifecycle consists of four main phases: Preparation, Detection & Analysis, Containment, Eradication & Recovery, and Post-Incident Activity.
Incorrect! Try again.
2In Digital Forensics, what is the primary purpose of a Chain of Custody?
A.To encrypt the data so it cannot be read by unauthorized users
B.To document the chronological history of evidence handling to ensure its admissibility in court
C.To compress the data to save storage space during analysis
D.To permanently delete malware found on the system
Correct Answer: To document the chronological history of evidence handling to ensure its admissibility in court
Explanation:The Chain of Custody is a legal document that tracks evidence from collection to trial. If the chain is broken, the integrity of the evidence is compromised, and it may be inadmissible in court.
Incorrect! Try again.
3Which of the following data sources provides the most detailed information about network traffic payload?
A.NetFlow
B.Syslog
C.Full Packet Capture (PCAP)
D.SNMP Traps
Correct Answer: Full Packet Capture (PCAP)
Explanation:NetFlow provides metadata (IPs, ports, volume), but Full Packet Capture (PCAP) records the entire packet, including the header and the actual data payload.
Incorrect! Try again.
4What is the specific goal of the Eradication phase in Incident Response?
A.To restore systems to normal operation
B.To limit the spread of the attack
C.To identify the root cause and remove the malicious artifacts (e.g., malware, breached accounts)
D.To train employees on future prevention
Correct Answer: To identify the root cause and remove the malicious artifacts (e.g., malware, breached accounts)
Explanation:Eradication involves removing the threat from the environment, such as deleting malware, disabling breached accounts, and patching vulnerabilities.
Incorrect! Try again.
5When collecting digital evidence, the Order of Volatility dictates which data should be collected first. Which of the following is the most volatile?
A.Hard Drive Data
B.CPU Registers and Cache
C.Archived Backup Tapes
D.System Logs on Disk
Correct Answer: CPU Registers and Cache
Explanation:The Order of Volatility states that data should be collected from most fugitive to least. CPU registers and cache are the most volatile, followed by RAM, temporary files, disk data, and finally archival media.
Incorrect! Try again.
6Which tool is primarily designed to aggregate, correlate, and analyze log data from various sources to detect security incidents?
A.Wireshark
B.SIEM (Security Information and Event Management)
C.Nmap
D.Metasploit
Correct Answer: SIEM (Security Information and Event Management)
Explanation:A SIEM (e.g., Splunk, QRadar) collects logs from multiple sources, correlates events, and alerts analysts to potential security incidents.
Incorrect! Try again.
7An analyst notices a large number of SYN packets sent to a target server without completing the TCP handshake (no final ACK). This is an indicator of which type of attack?
A.SQL Injection
B.SYN Flood (DoS)
C.Cross-Site Scripting
D.Phishing
Correct Answer: SYN Flood (DoS)
Explanation:In a SYN flood, the attacker sends many SYN requests. The server responds with SYN-ACK and waits for an ACK that never comes, exhausting server resources. This exploits the TCP 3-way handshake.
Incorrect! Try again.
8Which of the following is an indicator of a Buffer Overflow application attack?
A.The application crashes and the error log shows an instruction pointer overwriting memory at an unexpected address
B.The browser executes a script alert popup unexpectedly
C.The URL contains UNION SELECT statements
D.Network traffic shows large outbound file transfers
Correct Answer: The application crashes and the error log shows an instruction pointer overwriting memory at an unexpected address
Explanation:Buffer overflows occur when a program writes more data to a block of memory than it is allocated, often corrupting adjacent memory and causing crashes or execution of arbitrary code.
Incorrect! Try again.
9What is the primary function of a Write Blocker in digital forensics?
A.To prevent the forensic workstation from writing data to the seized evidence drive
B.To block malware from writing to the system registry
C.To stop hackers from accessing the network
D.To prevent log files from being overwritten by new logs
Correct Answer: To prevent the forensic workstation from writing data to the seized evidence drive
Explanation:A Write Blocker is a hardware or software tool that ensures the integrity of the evidence by allowing read-only access, preventing accidental modification during acquisition.
Incorrect! Try again.
10In the context of malware indicators, what is Beaconing?
A.The malware encrypts files and demands a ransom
B.The malware sends regular, periodic signals to a Command and Control (C2) server
C.The malware spreads rapidly to other devices on the LAN
D.The malware deletes system logs to hide its tracks
Correct Answer: The malware sends regular, periodic signals to a Command and Control (C2) server
Explanation:Beaconing (or heartbeat) is a characteristic behavior where compromised systems send signals to an attacker-controlled server at regular intervals to check for instructions.
Incorrect! Try again.
11Mathematically, a cryptographic hash function used in forensics, such as SHA-256, maps data of arbitrary size to a bit string of a fixed size. If is the hash function, which property ensures that it is computationally infeasible to find given ?
A.Collision Resistance
B.Pre-image Resistance
C.Avalanche Effect
D.Bitwise XOR
Correct Answer: Pre-image Resistance
Explanation:Pre-image resistance (or one-way property) ensures that given a hash value , it is difficult to find the original message such that .
Incorrect! Try again.
12Which monitoring tool operates by comparing network traffic against a database of known attack signatures?
A.Anomaly-based IDS
B.Signature-based IDS
C.Heuristic Analysis
D.Behavioral Monitoring
Correct Answer: Signature-based IDS
Explanation:Signature-based IDS looks for specific byte sequences or known malicious patterns (signatures) in network traffic, similar to how antivirus software uses virus definitions.
Incorrect! Try again.
13A user reports their computer performance has degraded significantly. You find a process using 99% CPU and communicating with a mining pool. What is the likely indicator?
A.Ransomware
B.Cryptojacking
C.Logic Bomb
D.Spyware
Correct Answer: Cryptojacking
Explanation:High CPU/GPU usage combined with connections to mining pools indicates unauthorized cryptocurrency mining, known as Cryptojacking.
Incorrect! Try again.
14Which Windows log file would you examine to find successful and failed login attempts?
A.Application Log
B.System Log
C.Security Log
D.Setup Log
Correct Answer: Security Log
Explanation:The Windows Security Log contains records of security-related events, such as valid and invalid logon attempts, as specified by the system's audit policy.
Incorrect! Try again.
15What is the difference between an Event and an Incident?
A.An event is a negative occurrence; an incident is a positive one.
B.An event is any observable occurrence in a system; an incident is an event that violates security policies.
C.An incident is a minor issue; an event is a major catastrophe.
D.There is no difference; the terms are interchangeable.
Correct Answer: An event is any observable occurrence in a system; an incident is an event that violates security policies.
Explanation:NIST defines an event as any observable occurrence (e.g., receiving an email). An incident is a violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices.
Incorrect! Try again.
16In the context of Data Sources, what is NetFlow data primarily composed of?
A.Full email contents and attachments
B.IP headers and payload data
C.Metadata including source IP, destination IP, ports, and byte counts
D.Operating system registry keys
Correct Answer: Metadata including source IP, destination IP, ports, and byte counts
Explanation:NetFlow does not capture packet content. It captures metadata about the flow of traffic, answering who, what, where, and when, but not specifically 'what content'.
Incorrect! Try again.
17Which of the following describes a False Positive in monitoring?
A.Malicious activity is present but the system fails to detect it
B.Benign (harmless) activity is flagged as malicious
C.Malicious activity is correctly identified
D.Benign activity is correctly ignored
Correct Answer: Benign (harmless) activity is flagged as malicious
Explanation:A False Positive occurs when an IDS/IPS or monitoring system triggers an alert for legitimate, non-malicious traffic.
Incorrect! Try again.
18During the Post-Incident Activity (Lessons Learned) phase, what is the primary objective?
A.To assign blame to the employee who caused the breach
B.To improve the incident response process and prevent recurrence
C.To restore the backup data
D.To collect forensic evidence for court
Correct Answer: To improve the incident response process and prevent recurrence
Explanation:The Lessons Learned phase focuses on analyzing how the team handled the incident to identify gaps, improve playbooks, and strengthen defenses for the future.
Incorrect! Try again.
19Which of the following is a clear indicator of Ransomware?
A.Slow internet speed
B.Mass modification of file extensions (e.g., to .locked or .cry) and a text file containing payment instructions
C.Unexpected pop-up ads in the browser
D.The computer restarting automatically after an update
Correct Answer: Mass modification of file extensions (e.g., to .locked or .cry) and a text file containing payment instructions
Explanation:Ransomware typically encrypts user files, changes their extensions, and leaves a ransom note (usually a text file or wallpaper) demanding payment.
Incorrect! Try again.
20Which technology helps automate the response to low-level security incidents without human intervention?
A.SOAR (Security Orchestration, Automation, and Response)
B.VPN (Virtual Private Network)
C.NAT (Network Address Translation)
D.Wireshark
Correct Answer: SOAR (Security Orchestration, Automation, and Response)
Explanation:SOAR platforms allow organizations to define workflows and playbooks that can automatically execute actions (e.g., block an IP, suspend a user) in response to specific triggers.
Incorrect! Try again.
21What is the Preparation phase of Incident Response primarily concerned with?
A.Scanning the network for active attackers
B.Establishing policies, tools, and training before an incident occurs
C.Restoring systems from backups
D.Removing malware from infected hosts
Correct Answer: Establishing policies, tools, and training before an incident occurs
Explanation:Preparation is the proactive phase involving setting up the CSIRT, creating policies, purchasing tools, and conducting training/simulations.
Incorrect! Try again.
22If an attacker injects the following string into a login field: ' OR '1'='1, what type of attack is being attempted?
A.Cross-Site Scripting (XSS)
B.SQL Injection (SQLi)
C.Buffer Overflow
D.Directory Traversal
Correct Answer: SQL Injection (SQLi)
Explanation:This is a classic tautology attack in SQL Injection. The statement '1'='1' is always true, potentially bypassing authentication logic.
Incorrect! Try again.
23Which of the following is a Physical Attack Indicator?
A.Unusual outbound UDP traffic
B.Broken tamper seals on a server chassis or bypassed locks
C.Multiple failed SSH login attempts
D.A spike in HTTP 404 errors
Correct Answer: Broken tamper seals on a server chassis or bypassed locks
Explanation:Physical indicators relate to the tangible security of the environment. Broken seals, forced doors, or piggybacking are physical security breaches.
Incorrect! Try again.
24What does EDR stand for in the context of endpoint monitoring?
A.Endpoint Data Recovery
B.Endpoint Detection and Response
C.External Defense Relay
D.Encrypted Digital Records
Correct Answer: Endpoint Detection and Response
Explanation:EDR tools monitor end-user devices to detect and respond to cyber threats like ransomware and malware.
Incorrect! Try again.
25In network forensics, what does ARP Poisoning typically indicate?
A.A Man-in-the-Middle (MitM) attack
B.A brute force attack on a password
C.A physical theft of a device
D.A SQL injection attack
Correct Answer: A Man-in-the-Middle (MitM) attack
Explanation:ARP Poisoning associates the attacker's MAC address with the IP address of a legitimate target (usually the gateway), allowing the attacker to intercept traffic (MitM).
Incorrect! Try again.
26What is a Playbook in Incident Response?
A.A list of all employee passwords
B.A predefined set of procedures and steps to handle specific types of incidents
C.A log file containing network traffic
D.A software tool for decrypting ransomware
Correct Answer: A predefined set of procedures and steps to handle specific types of incidents
Explanation:Playbooks (or runbooks) act as guides for analysts, outlining the specific steps to take when a certain type of incident (e.g., Phishing, Malware) is detected.
Incorrect! Try again.
27Which of the following best describes Steganography as an indicator of malicious activity?
A.Hiding data within another file, such as embedding a secret message inside an image
B.Encrypting a hard drive to prevent access
C.Deleting log files to cover tracks
D.Overwriting memory buffers
Correct Answer: Hiding data within another file, such as embedding a secret message inside an image
Explanation:Steganography is the practice of concealing a file, message, image, or video within another file. It is often used for covert data exfiltration.
Incorrect! Try again.
28What is the purpose of Isolation during the Containment phase?
A.To permanently delete the compromised system
B.To disconnect the infected system from the network to prevent lateral movement
C.To monitor the hacker's activity without them knowing
D.To backup the data on the system
Correct Answer: To disconnect the infected system from the network to prevent lateral movement
Explanation:Isolation involves removing the infected host from the network (physically or logically via VLAN/switch port) to stop the spread of the attack to other systems.
Incorrect! Try again.
29Which HTTP status code spike might indicate a Directory Traversal or scanning attempt where an attacker is guessing file paths?
A.200 OK
B.302 Found
C.404 Not Found
D.503 Service Unavailable
Correct Answer: 404 Not Found
Explanation:A high volume of 404 errors from a single IP suggests an attacker is using an automated tool to guess URLs or files that do not exist on the server.
Incorrect! Try again.
30Which file system artifact is useful for determining which programs have been executed on a Windows system?
A.Prefetch files
B.Hosts file
C.SAM database
D.Boot sector
Correct Answer: Prefetch files
Explanation:Windows Prefetch files are created to speed up application startup, but forensically they prove that a specific application was executed, along with the timestamp.
Incorrect! Try again.
31What is the CSIRT?
A.Computer System Internal Repair Team
B.Computer Security Incident Response Team
C.Cyber Security International Regulations Treaty
D.Central Server Internet Routing Table
Correct Answer: Computer Security Incident Response Team
Explanation:CSIRT stands for Computer Security Incident Response Team, the group responsible for receiving, reviewing, and responding to computer security incident reports and activity.
Incorrect! Try again.
32Which of the following is a Network-based indicator of compromise (IOC)?
A.A specific MD5 hash of a file on a hard drive
B.Communication with a known malicious IP address or domain
C.A registry key modification
D.A disabled antivirus service
Correct Answer: Communication with a known malicious IP address or domain
Explanation:Network-based IOCs are observed in traffic monitoring. Connecting to a blacklisted IP or C2 domain is a primary network indicator.
Incorrect! Try again.
33What is Data Exfiltration?
A.The unauthorized transfer of data from a computer to an outside party
B.The process of backing up data to the cloud
C.The encryption of data at rest
D.The deletion of data to free up space
Correct Answer: The unauthorized transfer of data from a computer to an outside party
Explanation:Data Exfiltration is the theft or unauthorized removal of data from a compromised system, often indicated by large outbound traffic transfers at unusual times.
Incorrect! Try again.
34Which command is commonly used by attackers to establish Persistence via the Windows Registry?
A.Adding an entry to HKLM\Software\Microsoft\Windows\CurrentVersion\Run
B.Running ping localhost
C.Viewing the systeminfo
D.Clearing the browser cache
Correct Answer: Adding an entry to HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Explanation:The 'Run' and 'RunOnce' registry keys are classic locations where malware adds entries to ensure it executes automatically every time the system boots.
Incorrect! Try again.
35In the context of IDS/IPS, what is a False Negative?
A.An alarm is raised for legitimate traffic
B.An attack occurs, but the system fails to detect and alert on it
C.The system blocks an attack successfully
D.The system is turned off
Correct Answer: An attack occurs, but the system fails to detect and alert on it
Explanation:A False Negative is the most dangerous error, where malicious traffic passes through the defense mechanisms without being flagged (Type II error).
Incorrect! Try again.
36Which of the following is an example of Social Engineering leading to an incident?
A.An attacker exploits an unpatched software vulnerability
B.An employee receives a call from 'IT Support' and gives away their password
C.A server crashes due to a power outage
D.A firewall blocks an incoming packet
Correct Answer: An employee receives a call from 'IT Support' and gives away their password
Explanation:Social Engineering relies on manipulating human psychology rather than technical hacking. Vishing (voice phishing) is a common example.
Incorrect! Try again.
37What is the primary difference between IDS and IPS?
A.IDS is for hardware, IPS is for software
B.IDS detects and alerts; IPS detects and actively blocks/prevents
C.IDS is more expensive than IPS
D.IPS monitors logs; IDS monitors traffic
Correct Answer: IDS detects and alerts; IPS detects and actively blocks/prevents
Explanation:IDS (Intrusion Detection System) is passive—it alerts. IPS (Intrusion Prevention System) is active—it sits in-line and can drop packets to stop the attack.
Incorrect! Try again.
38When analyzing a web server log, you see entries containing <script>alert('pwned')</script>. What attack vector is this?
A.SQL Injection
B.Cross-Site Scripting (XSS)
C.Brute Force
D.Rootkit
Correct Answer: Cross-Site Scripting (XSS)
Explanation:The presence of HTML script tags in input fields or URLs is the hallmark of Cross-Site Scripting (XSS), where attackers try to execute malicious scripts in the victim's browser.
Incorrect! Try again.
39Which forensic process creates a bit-for-bit copy of a drive?
A.File backup
B.Forensic Imaging / Cloning
C.Copy and Paste
D.Disk Defragmentation
Correct Answer: Forensic Imaging / Cloning
Explanation:Forensic Imaging creates an exact duplicate of the drive, including deleted files, slack space, and unallocated space, unlike a standard file copy.
Incorrect! Try again.
40A sudden, massive spike in inbound traffic originating from thousands of different IP addresses targeting a specific web server indicates:
A.A successful marketing campaign
B.A Distributed Denial of Service (DDoS) attack
C.A DNS poisoning attack
D.A privilege escalation attack
Correct Answer: A Distributed Denial of Service (DDoS) attack
Explanation:DDoS attacks involve a botnet (many compromised devices) flooding a target to overwhelm its resources and make it unavailable to legitimate users.
Incorrect! Try again.
41What is Volatility in the context of digital data?
A.The cost of the storage media
B.How easily data is lost when power is removed
C.The speed of data transfer
D.The encryption level of the data
Correct Answer: How easily data is lost when power is removed
Explanation:Volatility refers to data permanence. RAM is volatile (data is lost on power cycle), while Hard Drives are non-volatile (data remains without power).
Incorrect! Try again.
42Which of the following is an indicator of a Rootkit?
A.Files appearing on the hard drive that are invisible to the operating system's file explorer
B.A forgotten password
C.A phishing email in the inbox
D.An expired SSL certificate
Correct Answer: Files appearing on the hard drive that are invisible to the operating system's file explorer
Explanation:Rootkits modify the OS kernel or APIs to hide their presence. If a forensic tool sees a file but the OS API does not, a rootkit is likely hooking the system calls.
Incorrect! Try again.
43What does the equation have to do with Cybersecurity?
A.It is used to calculate Wi-Fi signal coverage area
B.It is the formula for RSA encryption
C.It is irrelevant to this subject
D.It calculates the area of a hard disk platter
Correct Answer: It is irrelevant to this subject
Explanation:This is a distractor question to test focus. While math is used in cryptography, the area of a circle formula is generally irrelevant to incident response procedures.
Incorrect! Try again.
44Which Windows Event ID is commonly monitored to detect Brute Force attacks?
A.Event ID 4624 (Successful Logon)
B.Event ID 4625 (Failed Logon)
C.Event ID 6005 (Event Log Service Started)
D.Event ID 7036 (Service Control Manager)
Correct Answer: Event ID 4625 (Failed Logon)
Explanation:A high volume of Event ID 4625 (An account failed to log on) in a short period is a strong indicator of a password guessing or brute force attack.
Incorrect! Try again.
45Which of the following represents a Heuristic detection method?
A.Matching a file hash against a known virus database
B.Analyzing code execution in a sandbox to see if it behaves like malware (e.g., modifying system files)
C.Blocking port 80 on the firewall
D.Whitelisting specific applications
Correct Answer: Analyzing code execution in a sandbox to see if it behaves like malware (e.g., modifying system files)
Explanation:Heuristic analysis looks for suspicious characteristics or behavior rather than exact signature matches, allowing detection of new, unknown (Zero-Day) malware.
Incorrect! Try again.
46What is the primary purpose of Log Retention Policies?
A.To ensure logs are deleted immediately to save space
B.To define how long logs must be kept to satisfy compliance and support forensic investigations
C.To encrypt logs for transport
D.To translate logs into different languages
Correct Answer: To define how long logs must be kept to satisfy compliance and support forensic investigations
Explanation:Retention policies dictate the lifespan of log data. Without historical logs, investigating an incident that started months ago is impossible.
Incorrect! Try again.
47What is a Rogue Access Point?
A.An unauthorized Wi-Fi access point installed on a secure network
B.A firewall rule that denies access
C.A user who forgot their password
D.A software update server
Correct Answer: An unauthorized Wi-Fi access point installed on a secure network
Explanation:A Rogue AP is a device attached to a network without permission (often by employees or attackers), bypassing network security controls and creating a backdoor.
Incorrect! Try again.
48Which of the following is a sign of Lateral Movement?
A.An employee checking their email from home
B.A user account utilizing PsExec or RDP to connect to multiple other internal servers in quick succession
C.Updating the Windows operating system
D.A single failed login attempt
Correct Answer: A user account utilizing PsExec or RDP to connect to multiple other internal servers in quick succession
Explanation:Lateral movement occurs when an attacker moves from the initial entry point to other systems within the network. Tools like PsExec, RDP, or SSH used anomalously indicate this.
Incorrect! Try again.
49In a Man-in-the-Middle (MitM) attack involving SSL/TLS, what warning might a user see?
A.The internet speed increases
B.An invalid or untrusted certificate warning in the browser
C.The computer screen turns blue
D.The mouse cursor moves on its own
Correct Answer: An invalid or untrusted certificate warning in the browser
Explanation:If an attacker intercepts HTTPS traffic, they cannot present a valid certificate signed by a trusted CA for the target domain (unless they compromised the CA), triggering a browser warning.
Incorrect! Try again.
50What is the role of NTP (Network Time Protocol) in Incident Response?
A.It encrypts network traffic
B.It ensures all logs across different devices have synchronized timestamps for accurate correlation
C.It routes packets between subnets
D.It prevents malware installation
Correct Answer: It ensures all logs across different devices have synchronized timestamps for accurate correlation
Explanation:Without synchronized time (via NTP), correlating logs from a firewall, a server, and an IDS to reconstruct a timeline of an attack is extremely difficult and prone to error.
Incorrect! Try again.
Give Feedback
Help us improve by sharing your thoughts or reporting issues.