Incident Investigation & Security Analytics Quiz

1. In forensic analysis, what is the purpose of creating a forensic image?

To delete sensitive data

To create an exact bit-by-bit copy for analysis without altering the original

To compress log files

To encrypt evidence

2. When documenting an incident investigation, what is the critical element for legal and compliance purposes?

Detailed timeline with preserved evidence chain of custody

Executive summary only

Recommendations for future improvements

List of affected systems

3. Which log aggregation challenge most impacts incident investigation accuracy?

Storage capacity limitations

Time zone inconsistencies across systems

Log file compression

Network bandwidth

4. In malware reverse engineering, what does behavioral analysis in a sandbox environment reveal?

Source code vulnerabilities

Runtime actions like registry modifications and file writes

Compiler optimization techniques

Author identity

5. When investigating command and control (C2) communications, which indicator is most diagnostic?

High bandwidth usage

Beaconing pattern to external IPs with regular intervals

Any outbound HTTPS connection

Increased CPU utilization

6. Which metric helps prioritize incident response efforts by measuring potential business impact?

Mean time to detect (MTTD)

Mean time to respond (MTTR)

Risk = Threat × Vulnerability × Impact

False positive rate

7. In network forensics, which protocol analysis reveals encrypted traffic patterns without decryption?

Packet payload inspection

Metadata analysis (packet size, timing, frequency)

Full packet capture decoding

SSL/TLS key extraction

8. What does the NIST Incident Response Lifecycle phase 'Detection and Analysis' primarily focus on?

Implementing security controls

Identifying and validating security incidents

Restoring systems to normal operations

Preventing future incidents

9. When correlating logs from multiple sources, which timestamp synchronization method is most critical?

Using local system clocks

Synchronizing all systems to a common time source (NTP)

Adjusting timestamps manually

Using relative time differences only

10. Which attack technique involves using legitimate system tools to evade detection?

Privilege escalation

Living off the Land (LOLBins)

Brute force attack

SQL injection

11. Which log source provides the most reliable evidence of successful lateral movement within a network?

Web server access logs

Windows Event ID 4624 (successful logon)

DHCP lease assignments

DNS query logs

12. What is the primary advantage of using threat intelligence feeds during incident investigation?

They eliminate the need for log analysis

They provide known malicious IPs, domains, and hashes for correlation

They guarantee 100% detection accuracy

They replace endpoint detection and response tools

13. When investigating a potential insider threat, which log type reveals user behavior patterns most clearly?

Firewall logs

User and Entity Behavior Analytics (UEBA) logs

Router configuration logs

Printer activity logs

14. Which indicator of compromise (IoC) would be most useful in identifying compromised systems across your network?

Suspicious file hash

User login time

Network latency

Hard drive capacity

15. In incident investigation, what does 'false positive' mean?

A legitimate security alert that requires action

An alert triggered by normal activity mistakenly flagged as malicious

A missed security incident

A detection that cannot be verified

16. Which tool is most effective for correlating security events across multiple data sources in real-time?

Wireshark

Security Information and Event Management (SIEM)

Nmap

Grep

17. When analyzing malware, what does static analysis examine without executing the file?

Runtime behavior and network connections

File headers, strings, and code structure

Memory allocation patterns

System calls and API hooks

18. Which MITRE ATT&CK tactic focuses on establishing persistence after initial compromise?

Execution

Persistence

Lateral Movement

Exfiltration

19. In incident response, what is the primary purpose of establishing a chain of custody for digital evidence?

To speed up the investigation process

To ensure evidence integrity and legal admissibility

To reduce storage costs

To prevent unauthorized access to servers

20. When investigating a suspected data exfiltration, which metric best indicates unauthorized data movement?

Increased CPU usage

Unusual outbound data volume to external IPs

High memory consumption

Increased login failures

Security Expert Leading a Complex Incident Investigation Quiz