8 Security Operations and Incident Response Free Online FlashCards

What is incident response?

Incident response is coordinated work to recognize and manage incidents, limit their effects, restore services, and use lessons learned to improve security.

How does a security incident differ from a security event?

A security event is an observed activity; an incident is an event or series of events that meets the organization’s criteria for security impact or policy violation.

Why correlate evidence from multiple log sources?

Correlating endpoint, identity, network, cloud, and application logs helps determine whether an alert indicates compromise; a single alert may not be enough.

What login pattern warrants investigation?

Repeated failed logins followed by a successful login from an unusual location and access to sensitive files form a stronger pattern that warrants investigation.

What are the main stages in NIST’s incident-response approach?

Prepare broadly, then Detect, Respond, and Recover; feed lessons learned into continuous improvement.

What does a chain of custody document?

A chain of custody records who handled evidence, when they handled it, and why.

What can a matching cryptographic hash establish?

Matching cryptographic hashes support the integrity of a file or image. A hash does not encrypt data or prove by itself that evidence is authentic.

Why analyze a forensic copy instead of the original?

When feasible, make a forensic copy and analyze the copy rather than the original, helping preserve the original evidence.

What is containment in incident response?

Containment limits ongoing harm. Measures can include isolating a device, restricting compromised accounts, revoking sessions or keys, blocking malicious traffic, or temporarily taking a service offline.

Why coordinate isolation in safety-critical environments?

In operational technology and other safety-critical environments, isolation can create hazards, so responders should coordinate containment with system owners.

How do least privilege and zero trust limit attacker movement?

Least privilege and zero trust mean verifying identity and device context, granting only needed access, and re-checking access as conditions change.

What does eradication address after containment?

Eradication removes the threat’s causes and persistence where possible, such as malicious tools, exploited weaknesses, unsafe configurations, or compromised credentials.