CND Network Incident Response Quiz

1. During incident response, what should be the priority when evidence collection conflicts with business continuity?

Always prioritize evidence collection over business operations

Always prioritize business continuity over evidence collection

Balance both while following organizational incident response procedures

Ignore evidence collection to maintain operations

2. In the context of network incident response, what does 'eradication' involve?

Removing the attacker's access and tools from compromised systems

Backing up all system data

Updating antivirus definitions

Increasing firewall rules

3. What is the primary advantage of implementing automated incident response capabilities?

Faster response times and reduced human error

Eliminates the need for security personnel

Prevents all security incidents

Reduces security tool costs

4. Which analysis technique examines malicious code behavior in a controlled environment?

Dynamic analysis

Static analysis

Network analysis

Behavioral profiling

5. In network forensics, what does 'chain of custody' ensure?

Evidence integrity and admissibility in legal proceedings

Faster incident resolution

Reduced investigation costs

Automatic threat elimination

6. What is the primary purpose of an incident response playbook?

Provide documented procedures for responding to specific incident types

List all network devices in the organization

Document employee vacation schedules

Describe marketing strategies

7. During a DDoS attack response, which mitigation technique involves diverting malicious traffic?

Rate limiting

Traffic scrubbing

Blackhole routing

Packet fragmentation

8. What is the primary value of threat intelligence in network incident response?

Provides context about attack methods, actors, and targets to improve defenses

Guarantees complete protection from all attacks

Eliminates the need for incident response planning

Reduces the cost of security tools

9. Which of the following best describes 'network segmentation' in incident response?

Dividing the network into zones to limit lateral movement of threats

Reducing network bandwidth

Removing all network connections

Increasing network speed

10. What is the primary goal of post-incident activities in the recovery phase?

Restore systems to normal operations and implement preventive measures

Increase security budgets

Blame individuals for the incident

Delete all incident logs

11. What is the primary goal of the detection phase in incident response?

Identify and recognize security incidents as quickly as possible

Document all network traffic for legal purposes

Eliminate all vulnerabilities from the network

Increase network bandwidth capacity

12. What is the primary function of a Security Information and Event Management (SIEM) system?

Collect, correlate, and analyze security events from multiple sources

Encrypt all network data

Provide web hosting services

Manage user passwords

13. Which containment strategy involves isolating an affected system from the network?

Segmentation

Quarantine

Patching

Blacklisting

14. What does the term 'indicator of compromise' (IoC) refer to?

Evidence or artifact indicating a system has been breached

A certificate used for encryption

A network protocol specification

A type of firewall rule

15. In forensic analysis of a compromised system, what is the primary reason to create a forensic image?

To preserve evidence in its original state for investigation

To speed up system recovery

To reduce disk space usage

To improve system performance

16. Which of the following is a characteristic of advanced persistent threats (APTs)?

They are easily detected by basic antivirus software

They maintain long-term presence and are difficult to detect

They only target small organizations

They always use the same attack method

17. What is the primary purpose of log aggregation in network incident response?

Centralize logs for correlation and faster threat detection

Reduce storage costs on network devices

Encrypt all network communications

Improve network routing efficiency

18. Which phase of incident response focuses on stopping the attack and preventing further damage?

Detection

Containment

Analysis

Recovery

19. In the context of incident response, what does SOAR stand for?

Security Orchestration, Automation and Response

System Operation and Risk

Security Operations and Recovery

Standard Operational Analysis Report

20. Which tool is most commonly used for real-time network packet analysis during incident investigation?

Wireshark

Nessus

Nmap

Metasploit