CySA+ Incident Response Quiz: Can You Contain & Recover?

1. Which log type is most critical for tracking user actions during an incident investigation?

Application logs

Audit logs

System logs

Network logs

2. In incident response, what does 'chain of custody' ensure?

Evidence integrity and legal admissibility

Fast incident containment

User account protection

Network performance optimization

3. What is the primary purpose of establishing an incident severity classification system?

To determine response priority and resource allocation

To assign blame to team members

To reduce insurance premiums

To delay incident response

4. Which tool is commonly used for collecting volatile data before system shutdown during incident response?

Wireshark

Memory dump tools like DumpIt or Belkasoft

Burp Suite

Metasploit

5. During the recovery phase, what is the most critical step before restoring systems?

Verifying that the threat has been completely eradicated

Notifying the CEO

Purchasing new software licenses

Scheduling system maintenance

6. What is the primary benefit of threat intelligence sharing during incident response?

Reduces investigation costs

Helps identify attack patterns and improve defenses

Eliminates the need for monitoring

Speeds up network performance

7. Which of these is NOT typically included in an incident response plan?

Contact information for stakeholders

Roles and responsibilities

Employee salary information

Communication procedures

8. In forensic imaging, what is the primary reason to use a write blocker?

To prevent accidental modification of evidence

To speed up the imaging process

To compress the image file

To encrypt the evidence

9. Which framework provides guidelines for incident response phases including Preparation, Detection, Containment, Eradication, and Recovery?

NIST Cybersecurity Framework

SANS Incident Handler's Handbook

ISO/IEC 27035

All of the above

10. What does the term 'dwell time' refer to in incident response?

Time spent in recovery phase

Time an attacker remains undetected in the network

Duration of the incident response team meeting

Time to restore backups

11. Which phase of incident response focuses on discovering and identifying that a security incident has occurred?

Detection and Analysis

Containment and Eradication

Recovery

Preparation

12. During eradication, what is the primary focus?

Removing the attacker's tools and restoring systems

Notifying all users of the incident

Purchasing new hardware

Increasing firewall rules

13. What is the primary advantage of implementing network segmentation before an incident occurs?

Reduces incident response time and limits lateral movement

Eliminates the need for firewalls

Increases network speed

Removes the need for antivirus software

14. Which containment strategy involves isolating an affected system from the network while maintaining access for investigation?

Full isolation

Segmentation

Lateral containment

Quarantine mode

15. In incident response, what does MTTD represent?

Maximum Time To Detection

Mean Time To Detect

Minimum Threat Threshold Detection

Managed Technical Team Deployment

16. What is the purpose of a post-incident review or lessons learned meeting?

To blame team members for failures

To identify improvements and prevent future incidents

To document overtime hours

To terminate underperforming staff

17. Which of the following is a key component of a playbook in incident response?

Step-by-step procedures for handling specific incident types

Employee vacation schedules

Financial budgets for IT

Marketing communication plans

18. During incident response, what does SOAR stand for?

Security Orchestration, Automation, and Response

System Operations and Automated Response

Security Oversight and Response

Structured Operations Assessment and Review

19. Which evidence preservation technique ensures data integrity by creating a cryptographic hash of files?

Chain of custody

Write blocker

MD5 or SHA-256 hashing

Forensic imaging

20. What is the primary goal of short-term containment during an active incident?

Restore systems to full functionality

Prevent spread of the threat and limit impact

Terminate all network connections

Delete all infected files immediately