CCNA Cybersecurity Incident Response Fundamentals

1. In incident response, what does 'recovery' refer to?

Restoring systems to normal operations

Identifying the attacker's location

Implementing additional security controls

Communicating with external stakeholders

2. During incident response, what is the significance of maintaining detailed incident logs?

To satisfy management curiosity

To support investigation, legal compliance, and future prevention

To occupy IT staff time

To increase system overhead

3. What is 'lateral movement' in the context of a security incident?

An attacker moving to a different country

Relocating office equipment

An attacker moving within a network after initial compromise

Transferring data between departments

4. Which tool is commonly used for real-time network traffic analysis during incident response?

Microsoft Word

Packet analyzer (e.g., Wireshark)

Web browser

Spreadsheet application

5. In forensic analysis, what does 'chain of custody' ensure?

Evidence integrity and admissibility in legal proceedings

Quick system recovery

Employee access to sensitive data

Faster incident detection

6. What is the primary objective of post-incident activities?

To punish employees involved

To analyze lessons learned and improve processes

To immediately shut down the company

To blame external vendors

7. Which communication channel is typically used for sensitive incident response discussions?

Public email

Social media platforms

Secure, encrypted communication channels

Text messages

8. During incident response, what is 'triage'?

Prioritizing incidents based on severity and impact

Permanently deleting compromised files

Notifying law enforcement immediately

Installing antivirus software on all systems

9. What is a primary indicator of compromise (IOC)?

A system's processing speed

Evidence suggesting unauthorized system access or activity

The number of active user accounts

A network device's firmware version

10. Which type of attack involves an attacker gaining unauthorized access to a system and maintaining it for extended periods?

Denial of Service

Advanced Persistent Threat (APT)

Phishing attack

Brute force attack

11. What is the purpose of an incident severity classification?

To assign blame to team members

To prioritize response resources and effort

To determine employee disciplinary action

To calculate insurance claims

12. Which log source is most valuable for detecting unauthorized access attempts?

Application logs

Authentication and access logs

Printer logs

Email delivery logs

13. During incident response, what does 'eradication' involve?

Identifying the threat actor

Removing the cause of the incident from systems

Notifying customers of the breach

Implementing new security policies

14. What is a zero-day vulnerability?

A vulnerability patched on the same day it was discovered

A previously unknown vulnerability with no available patch

A vulnerability that only affects older systems

A vulnerability announced but not yet exploited

15. During forensic analysis, what is the primary purpose of preserving evidence?

To restore system functionality immediately

To maintain chain of custody for legal proceedings

To prevent future incidents

To reduce incident response costs

16. Which of the following is a key component of an incident response plan?

Marketing strategy

Incident response team roles and responsibilities

Financial budgeting

Employee vacation schedules

17. What does SIEM stand for in the context of threat detection?

Security Information and Event Management

System Integration and Equipment Monitoring

Security Infrastructure and Enterprise Metrics

Synchronized Information Exchange Module

18. Which phase of incident response focuses on detecting and identifying that a security incident has occurred?

Detection and Analysis

Containment and Eradication

Recovery

Post-Incident Activities

19. Which containment strategy isolates a compromised system from the network?

Patch management

Network segmentation

Encryption deployment

Firewall configuration

20. What is the primary goal of the containment phase during incident response?

Restore systems to normal operations

Stop the attack and limit damage

Collect evidence for legal proceedings

Document lessons learned

CCNA Cybersecurity Incident Response Fundamentals Quiz