# Quiz ## Question 1 If you discover your messaging/email servers have been compromised during a data breach, what should you do as related to communications across the IR team?
Solution Utilize an out-of-band or alternate messaging network/environment
## Question 2 Who should the final incident report be shared with?
Solution Only those who have a specific need to know
## Question 3 Which two things are usually combined to calculate priority in incidents?
Solution Urgency and impact
## Quesiton 4 You are the incident response lead for your organization. Your team has identified a system that's currently compromised. The system is a critical system and shutting it down immediately may cause an adverse impact on the organization. What should your team do first?
Solution Perform a memory dump to be used for analysis
## Question 5 Which of the following is TRUE concerning containment?
Solution Containment is more of a strategy than a step
## Question 6 What should you NOT do during containment?
Solution Guarantee things or make such statements
## Question 7 Which of the following is NOT a common tool used in containment?
Solution Password crackers
## Question 8 What is the primary goal of eradication?
Solution To make sure the threat is completely removed per a predefined definition
## Question 9 How will an incident responder know how to clean or wipe a machine properly during eradication?
Solution Using processes defined by the organization via policies and procedures
## Question 10 Who should be notified first of the eradication of a threat?
Solution The rest of the IR team
## Question 11 What team or practice in the organization is likely to be able to provide the most assistance or guidance during recovery?
Solution Business Continuity (BC) and Disaster Recovery (DR) teams
## Question 12 Which departments or practices are most likely to be impacted by restoration during the recovery phases? (Pick TWO)
Solution * Change management * Configuration management
## Question 13 What traditional forensics/IR practice is usually not possible if the data breach happened in a cloud service provider (CSP) environment using Platform-as-a-Service models such as Amazon EC2 or Microsoft Azure?
Solution Take a physical, bit-to-bit, forensically-sound image of the suspected hard drive
## Question 14 Why are system monitoring tools useful for the recovery phase in incident response?
Solution They may be used to monitor systems to ensure abnormal behavior has not returned
## Question 15 Why should implementation of improvements after the follow-up step be phased into the process? (Select THREE)
Solution * Solutions may impact operations and other critical business functions * May require significant resources and input from other teams * Will usually require some type of impact assessment
## Question 16 Which criteria would MOST likely lead to changes in the IR playbook?
Solution Team was not able to follow the playbook effectively