CySA+ Root Cause Analysis Techniques Quiz

1. What is the term for the period between when an attacker gains access and when the organization detects the breach?

Dwell time

Response time

Remediation window

Containment period

2. What is the key difference between containment and eradication in the incident response lifecycle?

Containment stops spread; eradication removes the threat

Eradication is faster than containment

Containment requires legal approval; eradication does not

They are the same process

3. Which CySA+ concept emphasizes continuous monitoring and quick response to detected anomalies in network behavior?

Passive defense

Active threat hunting

Predictive analytics

Retrospective analysis

4. In incident response, what term describes the process of removing malware and unauthorized access from affected systems?

Containment

Eradication

Recovery

Analysis

5. Which metric measures how quickly an organization detects a security incident from the time of occurrence?

Mean time to respond

Mean time to detect

Mean time to recover

Mean time to remediate

6. What is the primary purpose of creating an incident timeline during forensic analysis?

To calculate incident costs

To establish sequence of events and identify attack vectors

To assign accountability

To satisfy audit requirements

7. Which containment strategy aims to stop an active attack while minimizing impact to business operations?

Eradication

Short-term containment

System restoration

Evidence collection

8. In root cause analysis, what does the fishbone diagram (Ishikawa) help identify?

Network topology

Multiple contributing factors to a problem

Patch availability

User privilege levels

9. Which log source typically provides the most detailed information about user account authentication attempts?

Application logs

Authentication/access logs

Network traffic logs

System error logs

10. When conducting a post-incident review, which stakeholder group should provide input on technical findings and mitigation steps?

Legal and compliance teams only

Executive leadership only

IT security and technical teams

Marketing and communications only

11. Which technique involves examining system logs, network traffic, and file systems to reconstruct the sequence of events during an incident?

Timeline analysis

Vulnerability scanning

Threat modeling

Patch management

12. Which tool is commonly used to extract and analyze memory contents during a live forensic investigation?

Volatility

Nessus

Metasploit

Burp Suite

13. In incident response, which document provides step-by-step actions to follow when a specific incident type occurs?

Incident playbook

Risk register

Asset inventory

Compliance checklist

14. What type of analysis examines how an attacker moved through a network after initial compromise?

Lateral movement analysis

Vulnerability assessment

Risk quantification

Threat intelligence

15. When preserving evidence for forensic analysis, which principle ensures data integrity throughout the investigation?

Chain of custody

Least privilege

Defense in depth

Zero trust architecture

16. Which phase of incident response focuses on identifying and understanding what happened during the security event?

Preparation

Detection and analysis

Containment

Post-incident activities

17. What does SIEM stand for in the context of incident detection and analysis?

Security Information and Event Management

System Integrity and Encryption Module

Secure Infrastructure Evaluation Mechanism

Software Integration and Endpoint Monitoring

18. Which forensic artifact would most likely reveal unauthorized access attempts on a Windows system?

Security Event Log

Temporary files folder

Browser cache

Recycle bin

19. In the 5 Whys technique, you repeatedly ask 'why' to drill down through layers of causation. How many levels typically indicate sufficient depth?

Three

Five

Seven

Ten

20. What is the primary goal of performing a root cause analysis after a security incident?

Assign blame to team members

Identify underlying factors to prevent recurrence

Document compliance violations

Calculate financial losses