4.0 Respond Flashcards

1
Q

Incident response plans and processes

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Communication with internal and external stakeholders

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Personnel role and responsibilities

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Incident reporting

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Allow list/block list

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

IDS/IPS rules configuration

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Network segmentation

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Web content filtering

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Port blocking

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Firewall

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

IDS/IPS

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Web proxy

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Anti-malware

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Endpoint security solutions

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

DLP

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Windows tools to analyze incidents

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Registry

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Network

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

File system

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Malware

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Processes

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Services

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Volatile memory

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Active Directory tools

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Linux- based tools to analyze incidents

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Network

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

File system

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Malware

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Processes

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Volatile memory

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Session management

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Digital evidence collection

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Physical evidence collection

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Chain of custody

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Static analysis

A
36
Q

Dynamic analysis

A
37
Q

FTK

A
38
Q

EnCase

A
39
Q

eDiscovery

A
40
Q

Forensic Explorer

A
41
Q

Kali Linux Forensic Mode

A
42
Q

CAINE

A
43
Q

SANS SIFT

A
44
Q

Volatility

A
45
Q

Binalyze AIR

A
46
Q

Forensically sound duplicates

A
47
Q

Document and communicate results

A
48
Q

Logs

A
49
Q

Data analysis

A
50
Q

Intrusion prevention or detection systems (IDS/IPS)

A
51
Q

Forensic Analysis

A
52
Q

Correlation Analysis

A
53
Q

Event correlation tools and techniques

A
54
Q

Root cause analysis

A
55
Q

Alerting systems

A
56
Q

Incident reports

A
57
Q

Document and communicate results

A
58
Q

Chain of command

A
59
Q

Policies

A
60
Q

Procedures

A
61
Q

Incident response plan

A
62
Q

Security configuration controls

A
63
Q

Baseline configurations

A
64
Q

Hardening documentation

A
65
Q

Document measures implemented

A
66
Q

Threat actors

A
67
Q

Patterns of activity

A
68
Q

Methods

A
69
Q

Tactics

A
70
Q

Early stages of campaign

A
71
Q

Key facts of the infrastructure

A
72
Q

Artifacts and tools used

A
73
Q

Techniques

A
74
Q

Technological

A
75
Q

Non-technological

A
76
Q

Procedures

A
77
Q

Communication policies and procedures

A
78
Q

Internal communication methods

A
79
Q

Secure channels

A
80
Q

Out-of-band communications

A
81
Q

Local law enforcement

A
82
Q

Stockholders

A
83
Q

Breach victims

A
84
Q

Media

A
85
Q

Other CERTS/CSIRTS

A
86
Q

Vendors

A