6 Security Operations and Incident Response Free Online FlashCards

What is continuous monitoring?

Continuous monitoring collects and assesses information about assets, threats, vulnerabilities, and control effectiveness so an organization can respond to changing risk.

How does an IPS differ from an IDS?

An IDS detects and alerts on suspicious activity. An IPS can also block or disrupt that activity.

What does a SIEM do?

A SIEM centralizes and correlates events from multiple sources, often generating alerts using rules, thresholds, and analytics.

How do an event, an alert, and an incident differ?

An event is an observed occurrence; an alert is a condition needing review; an incident requires a coordinated response under organizational policy.

What are the core steps of vulnerability management?

It is an ongoing cycle of discovering assets, identifying weaknesses, assessing risk, treating findings, and verifying the result.

What does a CVSS score not determine on its own?

A CVSS score describes vulnerability severity characteristics, but it is not by itself a complete organizational risk decision.

What is a zero-day vulnerability?

A zero-day is a vulnerability exploited or disclosed before an effective patch is available.

What sequence organizes incident response activities?

Prepare; detect and analyze; contain; eradicate; recover; and learn. These activities can overlap and repeat.

Why might responders collect volatile evidence before shutting down a system?

Memory, running processes, network connections, and temporary state may disappear when a system is shut down, so collection order should account for investigative goals and risk.

What does a chain of custody document?

A chain of custody is a documented history of evidence possession and handling, including who collected it, when, where, how, and why.

What can a cryptographic hash not prove about a file?

Cryptographic hashes help demonstrate that a forensic copy has not changed, but they do not prove who created a file or that its contents are truthful.

What does the recovery time objective (RTO) measure?

The recovery time objective (RTO) is the target maximum time to restore a service after a disruption.