CySA+ Root Cause Analysis Techniques Quiz

1. What is the primary role of a security information and event management (SIEM) system in incident detection?

To generate incident tickets automatically

To aggregate and analyze security events in real-time

To replace the incident response team

To prevent all cyberattacks

2. What is the primary benefit of conducting regular tabletop exercises in incident response planning?

To identify gaps in procedures and team readiness

To prevent all future incidents

To reduce the incident response budget

To eliminate the need for incident response training

3. Which framework provides guidance for incident response and is widely adopted by government agencies?

ISO 27035

NIST Cybersecurity Framework

CIS Controls

SANS Incident Handler's Handbook

4. In root cause analysis, what is the purpose of identifying 'contributing factors'?

To blame multiple departments equally

To understand conditions that enabled the incident

To reduce the incident severity rating

To delay remediation efforts

5. What does 'dwell time' measure in the context of incident response?

The time an attacker remains undetected in the network

The duration of the incident response team meeting

The time to purchase new security tools

The delay in customer notification

6. Which of the following is a key metric used to measure incident response effectiveness?

Time to detect and contain the incident

Number of employees on the response team

Total IT budget allocated

Employee satisfaction scores

7. During incident investigation, what is the significance of timeline reconstruction?

It helps identify the sequence of events and attack progression

It determines the cost of the incident

It eliminates the need for forensic analysis

It provides only historical context without actionable value

8. What is the primary objective of establishing an incident response playbook?

To eliminate the need for incident response training

To provide documented procedures for handling specific incident types

To guarantee incidents will never occur

To reduce the incident response team size

9. Which technique involves analyzing how a system failed rather than just what failed?

Fault tree analysis

Timeline reconstruction

Asset inventory review

Patch management audit

10. In root cause analysis, what is a 'systemic issue'?

A problem affecting only the operating system

An underlying weakness in processes or controls

A temporary network connectivity problem

An issue that requires immediate system shutdown

11. Which root cause analysis technique uses a visual diagram to trace back from a problem to its underlying causes?

Fishbone diagram

SWOT analysis

Risk matrix

Gantt chart

12. Which of the following best describes 'indicators of compromise' (IoCs)?

Artifacts that suggest an incident has occurred

Policies that prevent all security incidents

Tools used only in forensic labs

Metrics that measure incident response speed

13. During the eradication phase, what action is most critical?

Notifying all customers immediately

Removing the attacker's access and fixing vulnerabilities

Shutting down all network systems

Hiring external consultants

14. What is the primary advantage of using a threat intelligence platform during incident response?

It eliminates the need for forensic analysis

It correlates incident data with known threat indicators

It guarantees zero future incidents

It reduces the need for incident response team training

15. Which analysis method evaluates the potential impact and likelihood of future incidents based on historical data?

Trend analysis

Root cause analysis

Risk assessment

Correlation analysis

16. In forensic analysis, what is the primary purpose of maintaining a chain of custody?

To prove the integrity and admissibility of evidence

To speed up the investigation process

To reduce investigation costs

To prevent employee access to data

17. What does NIST recommend as the primary focus during the containment phase of incident response?

Eradicating the threat from all systems

Stopping the spread and impact of the incident

Restoring all systems to full capacity

Communicating with external stakeholders only

18. Which of the following is NOT a common incident response phase?

Preparation

Detection and Analysis

Market Expansion

Post-Incident Activities

19. In the '5 Whys' technique, how many levels of questioning should be conducted to find the root cause?

Exactly five times, no more or less

Until the root cause is identified, not necessarily five

At least ten times for thoroughness

Only three times for efficiency

20. What is the primary goal of conducting a post-incident review in incident response?

Assign blame to specific team members

Identify lessons learned and prevent recurrence

Document costs for budget purposes

Determine compensation claims