Lesson 12 - CertMaster

Incident Response (IR)

The process of investigating alerts from monitoring systems and user-reported issues, governed by policies and procedures.

Incident Handling Phases

An essential process within incident response that involves preparation, detection, analysis, containment, eradication, recovery, and lessons learned.

Digital Forensics

The practice of collecting, preserving, and analyzing digital evidence to assist legal proceedings and investigations.

SIEM

Security Information and Event Management software that collects and correlates data from multiple sources to provide alerting, monitoring, and reporting capabilities.

Threat Hunting

The proactive process of searching for indicators of compromise within a network or system, using threat intelligence.

CIRT

Computer Incident Response Team, consisting of members with diverse security competencies that respond to cybersecurity incidents.

Due Process

Fair application of laws that ensures that evidence collected in a forensic investigation is admissible in court.

Chain of Custody

Documentation that records the handling and movement of evidence to establish its integrity during a legal investigation.

Playbook

A documented set of procedures that guides analysts through the steps of detecting, responding to, and mitigating specific threat scenarios.

Isolation-based Containment

A technique that removes affected components from the network environment to prevent further damage during an incident.

Segmentation-based Containment

A method of isolating a host or group of hosts within a controlled network segment to analyze and manage incidents.

Log Data

Records generated by systems, networks, and applications that provide crucial information for investigating and responding to incidents.

Alert Fatigue

A phenomenon where security analysts become desensitized to alerts due to the overwhelming number of false positives, potentially missing real threats.

E-Discovery

The practice of identifying, collecting, and producing electronically stored information (ESI) for legal proceedings.

Indicators of Compromise (IOC)

Artifacts or data that indicate potential malicious activity or breaches that have occurred within an environment.

First Responder

The individual designated to oversee the initial response to a security incident and to coordinate further actions.

Malicious Activity Eradication

The process of removing unauthorized access points, malware, and intrusions from affected systems after containment has occurred.

False Positive

An alert that indicates threat activity is present when no actual threat activity exists.

Vulnerability Scanner

A tool that identifies and reports security weaknesses or inadequacies in networked systems.

Chain of Custody Form

A document that records who collected evidence, how it was handled, and where it is stored to maintain integrity for legal proceedings.

Cross-departmental Training

Training that involves multiple departments to enhance coordinated efforts in incident detection and response.

Security Orchestration, Automation, and Response (SOAR)

Technologies that integrate and automate security tools to improve incident response and management.

Network Monitoring Tools

Tools that collect and assess data from network devices to detect anomalies or performance issues.

Intrusion Detection System (IDS)

A technology designed to monitor network traffic for suspicious activity and potential threats.

Data Loss Prevention (DLP)

A security strategy that aims to prevent sensitive data from being lost, accessed, or misused by unauthorized users.

When conducting a cybersecurity investigation, how does recording the evidence acquisition process on video help to ensure the collected evidence's integrity?

Demonstrates law enforcement took the evidence directly from the crime scene.

A large financial institution has discovered unusual network activity indicating a potential breach of sensitive data. The attacker is extracting large amounts of data over an extended period. The security team suspects the adversary may be an insider with advanced knowledge of the system's weaknesses. What incident response steps are MOST relevant for addressing the targeted data exfiltration incident?

Containment, eradication, detection, and recovery

Why is de-duplication important in e-discovery software tools?

De-duplication reduces the volume of data for forensic analysis.

When conducting a cybersecurity investigation, what is the significance of using a memory dump to extract valuable data from a computer system?

Memory dumps recover lost files and volatile memory from mass storage devices.

What is the primary purpose/action of the containment phase of cybersecurity incident management during an incident response lifecycle for a user account? (Select the two best options.)

What does “Single pane of glass analysis” refer to?

Use of an SIEM on a network/system