QCM : Fundamentals of Cyber Incident Handling — 18 questions

Questions et réponses du QCM

1. What best describes incident handling?

A single alarm condition that confirms malicious activity has already succeeded
A routine backup process used to restore deleted files after user error
A set of procedures used to manage and respond to security incidents in a computer or network environment
A hardware maintenance workflow for replacing failed network components

A set of procedures used to manage and respond to security incidents in a computer or network environment

Explication

Incident handling is the defined set of procedures for managing and responding to security incidents. The other options describe unrelated operational tasks or a confirmed outcome rather than the handling process.

2. Which situation falls within the scope of incident handling?

A routine change to a printer driver
A planned employee vacation request
A software update that improves performance without disruption
A malicious insider stealing intellectual property

A malicious insider stealing intellectual property

Explication

Incident handling covers more than external attacks and includes malicious insiders and loss of intellectual property. The other choices are normal administrative or maintenance activities, not incidents.

3. Why is incident handling necessary for an organization?

To guarantee that every alert is immediately confirmed as a breach
To replace the need for system monitoring and logging
To eliminate the need for any preventive security controls
To reduce the loss of confidentiality, integrity, and availability during security incidents

To reduce the loss of confidentiality, integrity, and availability during security incidents

Explication

Incident handling is needed when an organization cannot afford damage to confidentiality, integrity, or availability. It supports reducing the impact of incidents, not replacing other security functions.

4. What is the main role of incident prioritization?

To rank incidents by severity so the highest-impact events receive immediate attention and resources
To ensure low-impact events always receive the most resources
To delay response until all incidents have identical evidence quality
To assign every incident to the same team member

To rank incidents by severity so the highest-impact events receive immediate attention and resources

Explication

Prioritization ranks incidents by severity so the most serious events are handled first. The other options reverse or ignore the purpose of triage and resource allocation.

5. What is the main purpose of the reconnaissance stage in the cyber kill chain?

To identify targets, gather information, and find vulnerabilities to exploit
To establish remote access to a compromised machine
To send the payload to the victim through email or a website
To trigger the delivered payload and execute code on the target

To identify targets, gather information, and find vulnerabilities to exploit

Explication

Reconnaissance is the preparatory stage where the attacker learns about targets and looks for weaknesses. Delivery, exploitation, and command and control occur later in the chain.

6. Which stage involves sending the exploit or payload to the victim, often through phishing or a malicious website?

Weaponize
Exploitation
Delivery
Command and control

Delivery

Explication

The delivery stage is when the malicious payload or exploit is sent to the victim. Weaponize creates the payload, while exploitation triggers it and command and control follows compromise.

7. What is the incident response lifecycle best described as?

A purely linear sequence with no feedback between stages
A one-time checklist that ends after the first alert is reviewed
A process used only after recovery has already completed
A cyclic process where new evidence can change the next response steps

A cyclic process where new evidence can change the next response steps

Explication

The lifecycle is cyclic, not linear, and newly discovered evidence can change the next actions. This is why response steps can be revisited as investigation continues.

8. Which activity belongs to the recovery stage of the incident response lifecycle?

Finding malicious events and gathering initial context
Building team capability before an incident occurs
Identifying targets and gathering attacker information
Using a recovery plan to restore business operations after disruption

Using a recovery plan to restore business operations after disruption

Explication

Recovery uses a recovery plan to bring business operations back after disruption. Preparation and detection are earlier stages, while target identification belongs to the attack lifecycle, not incident response.

9. What is a jump bag used for in incident readiness?

A communication channel used only for executive reporting
A secure archive for long-term evidence retention
A pre-packed kit of ready-to-use forensic and investigative tools
A formal record of who accessed evidence and when

A pre-packed kit of ready-to-use forensic and investigative tools

Explication

A jump bag is a ready-to-use kit so the team can begin work immediately without delays. It is not the evidence record itself or a storage or reporting system.

10. Why should incident documentation systems be independent from the organization’s infrastructure?

Because they are meant to replace forensic workstations
Because the domain may be fully compromised and systems can become unavailable
Because they are used only for storing antivirus definitions
Because documentation is only needed after the incident is closed

Because the domain may be fully compromised and systems can become unavailable

Explication

Documentation systems should not depend on potentially compromised internal infrastructure, since those systems may be unavailable during an incident. Independence helps ensure records remain accessible and trustworthy.

11. Which control is specifically described as limiting PowerShell features to reduce script-based attack capability?

Network segmentation
SSL/TLS interception
PowerShell ConstrainedLanguage mode
Attack Surface Reduction rules

PowerShell ConstrainedLanguage mode

Explication

PowerShell ConstrainedLanguage mode restricts PowerShell language features to make script-based attacks harder. ASR rules also reduce exposure, but they are a broader Defender control rather than a PowerShell language restriction.

12. Why is SSL/TLS interception useful for IDS/IPS in a hardened environment?

It makes network segmentation unnecessary for critical systems
It replaces endpoint hardening by blocking workstation attacks
It prevents all encrypted traffic from reaching internal hosts
It lets detection inspect content on the wire instead of relying on IP reputation

It lets detection inspect content on the wire instead of relying on IP reputation

Explication

SSL/TLS interception decrypts traffic so IDS/IPS can analyze the actual content and detect malicious behavior more effectively. It does not replace segmentation or endpoint hardening.

13. What is the main purpose of the Detection and Analysis phase in incident handling?

To restore business operations after disruptions have ended
To preserve evidence in a secure facility for later legal review
To spot incidents using sensors and logs while building understanding for the next response actions
To isolate business-critical systems so breaches cannot spread

To spot incidents using sensors and logs while building understanding for the next response actions

Explication

Detection and Analysis focuses on identifying malicious events and gathering enough context to guide the next response steps. Recovery and evidence storage belong to later or different activities.

14. Which statement best describes an initial investigation after an alert?

It is early fact-finding to collect enough context before escalating to a wider response
It is the act of ranking incidents by severity so resources are assigned
It is the process of creating forensic images and chain-of-custody forms
It is the final step used to close the incident report after recovery

It is early fact-finding to collect enough context before escalating to a wider response

Explication

Initial investigation is the early effort to gather context before the full response team is engaged. Severity ranking is triage, not initial investigation.

15. What is the primary purpose of an incident timeline?

To rank incidents by business impact and assign immediate resources
To list all affected users and their password changes during recovery
To record only the first alert that triggered the investigation
To provide a time-sorted record of event details that adds context for later evidence

To provide a time-sorted record of event details that adds context for later evidence

Explication

An incident timeline organizes events by when they occurred, helping investigators understand the sequence and place later evidence in context. It is not a prioritization tool.

16. Which factor is a key triage question for estimating incident severity and extent?

Whether the attacker used phishing or a drive-by download
Whether the incident affects business-critical systems and how many systems are impacted
Whether the evidence was stored on a forensic workstation
Whether the incident report has already been signed off by management

Whether the incident affects business-critical systems and how many systems are impacted

Explication

Triage specifically uses questions about business-critical exposure, number of impacted systems, and similar scope indicators to gauge severity. The attack method may matter in investigation, but it is not the core triage criterion described here.

17. What is the recommended first step in the IOC usage cycle during an investigation?

Delete suspicious files before collecting additional evidence
Shut down the affected system to prevent further damage
Move immediately to full recovery without collecting leads
Create and use IOCs to search for signs of malicious activity

Create and use IOCs to search for signs of malicious activity

Explication

The IOC cycle begins by creating and using indicators to search for related malicious activity, which can then reveal new leads and impacted systems. Shutting down too early can destroy volatile evidence.

18. Why should investigators avoid using WinRM-style logins in some IOC searches on compromised systems?

Because they require that evidence be deleted after the session
Because they can cache privileged credentials on remote systems after login
Because they prevent any IOC collection from occurring
Because they cannot be used with Windows environments

Because they can cache privileged credentials on remote systems after login

Explication

WinRM is singled out as a protocol to avoid in this context because it can cache privileged credentials on remote systems after login. The goal is to search for IOCs without leaving unnecessary credential traces.

Révisez avec les flashcards

Mémorisez les réponses avec 18 flashcards sur Fundamentals of Cyber Incident Handling.

Incident handling — definition?

Procedures to manage security incidents.

Scope of incident handling?

Includes attacks, insiders, availability, and IP loss.

Incident handling value?

Restores operations quickly and minimizes damage.

Voir les flashcards →

Approfondir avec la fiche

Consultez la fiche de révision complète sur Fundamentals of Cyber Incident Handling.

Voir la fiche →

Cours similaires

Gestion des fichiers en PHP

Programmation

Identification utilisateur en PHP

Programmation

Automated PCB Fault Diagnosis

Intelligence Artificielle

Rôle d'un système d'exploitation

Questions techniques projet Compawgnon

Bases de Python pour débutants

Programmation

Crée tes propres QCM

Importe ton cours et l'IA génère des QCM avec corrections en 30 secondes.

Générateur de QCM