Cybersecurity Plus Bootcamp Module 12 Quiz

Which of the following lists the seven processes in the CompTIA incident response lifecycle?

Planning, reporting, mitigation, analysis, recovery, post-incident review, compliance

Correct Incorrect Correct answer

Preparation, detection, analysis, containment, eradication, recovery, lessons learned

Correct Incorrect Correct answer

Planning, detection, monitoring, mitigation, reporting, recovery, compliance

Correct Incorrect Correct answer

Identification, isolation, investigation, removal, recovery, review, readiness

Correct Incorrect Correct answer

True or False: The “first responder” is the first person to report an incident to the Computer Incident Response Team (CIRT).

TRUE

Correct Incorrect Correct answer

FALSE

Correct Incorrect Correct answer

True or False: All security alerts should be sent to every employee to maintain transparency.

TRUE

Correct Incorrect Correct answer

FALSE

Correct Incorrect Correct answer

Why is an out-of-band communication method important for incident responders?

To ensure alerts are faster than normal email

Correct Incorrect Correct answer

To prevent alert fatigue

Correct Incorrect Correct answer

To communicate securely if primary networks are compromised

Correct Incorrect Correct answer

To allow remote workers to connect to the VPN

Correct Incorrect Correct answer

Which type of incident response exercise best simulates a real intrusion scenario?

Tabletop exercise

Correct Incorrect Correct answer

Red team/blue team simulation

Correct Incorrect Correct answer

Checklist review

Correct Incorrect Correct answer

Communication drill

Correct Incorrect Correct answer

What does it mean when digital evidence is described as “latent”?

It cannot be seen directly and must be interpreted

Correct Incorrect Correct answer

It is encrypted by default

Correct Incorrect Correct answer

It is only stored in the cloud

Correct Incorrect Correct answer

It is hidden inside binary files

Correct Incorrect Correct answer

Which process must be followed when transferring digital evidence to another team?

Data retention scheduling

Correct Incorrect Correct answer

Chain of custody

Correct Incorrect Correct answer

Data replication

Correct Incorrect Correct answer

Access control listing

Correct Incorrect Correct answer

True or False: To ensure evidence integrity, you should hash the media before making an image copy.

TRUE

Correct Incorrect Correct answer

FALSE

Correct Incorrect Correct answer

If the ARP cache contains critical evidence, should you shut down the PC before imaging the hard drive?

Yes, to preserve the cache

Correct Incorrect Correct answer

No, because the ARP cache is stored in volatile memory

Correct Incorrect Correct answer

Yes, to prevent malware spread

Correct Incorrect Correct answer

No, because ARP entries are written to disk

Correct Incorrect Correct answer

Which type of log should be included in addition to firewall, application, OS security, IPS/IDS, and network logs?

Web server logs

Correct Incorrect Correct answer

Switch logs

Correct Incorrect Correct answer

DNS logs

Correct Incorrect Correct answer

Endpoint logs

Correct Incorrect Correct answer

What is the primary use of a security dashboard?

To store archived logs

Correct Incorrect Correct answer

To visualize and summarize key security data for daily operations

Correct Incorrect Correct answer

To automatically remediate all alerts

Correct Incorrect Correct answer

To encrypt log files

Correct Incorrect Correct answer

True or False: File system audit settings cannot be customized in security logging.

TRUE

Correct Incorrect Correct answer

FALSE

Correct Incorrect Correct answer

Which data source allows frame-by-frame analysis of events that triggered an IDS alert?

Packet capture

Correct Incorrect Correct answer

Host event logs

Correct Incorrect Correct answer

Syslog

Correct Incorrect Correct answer

NetFlow records

Correct Incorrect Correct answer

What is the primary function of a SIEM?

Encrypt all log data

Correct Incorrect Correct answer

Aggregate, normalize, and correlate security events from multiple sources

Correct Incorrect Correct answer

Replace intrusion prevention systems

Correct Incorrect Correct answer

Block suspicious IP addresses automatically

Correct Incorrect Correct answer

In SIEM architecture, what is the difference between a collector and a sensor?

Collectors store log archives; sensors run antivirus scans

Correct Incorrect Correct answer

Collectors receive and parse logs; sensors capture network traffic

Correct Incorrect Correct answer

Collectors filter alerts; sensors aggregate logs

Correct Incorrect Correct answer

Collectors normalize logs; sensors export flow records

Correct Incorrect Correct answer

Why is a parser necessary for logs from a UTM gateway in a SIEM?

To compress large log files

Correct Incorrect Correct answer

To encrypt the logs in transit

Correct Incorrect Correct answer

To forward logs to the firewall

Correct Incorrect Correct answer

To translate logs into a standard format for correlation

Correct Incorrect Correct answer

Which activity should be added to log aggregation, alerting, scanning, reporting, and response to align with Security+ objectives?

Archiving

Correct Incorrect Correct answer

Load balancing

Correct Incorrect Correct answer

Encrypted backup

Correct Incorrect Correct answer

Incident drill

Correct Incorrect Correct answer

Which monitoring tool generates flow records for network analysis?

NetFlow/IPFIX probes

Correct Incorrect Correct answer

Packet capture

Correct Incorrect Correct answer

Syslog server

Correct Incorrect Correct answer

Security dashboard

Correct Incorrect Correct answer

Cybersecurity Plus Bootcamp Module 12 Quiz

Cybersecurity Plus Bootcamp Module 12 Quiz

Quiz Summary

Information

Results

Results

Categories

1. Question

2. Question

3. Question

4. Question

5. Question

6. Question

7. Question

8. Question

9. Question

10. Question

11. Question

12. Question

13. Question

14. Question

15. Question

16. Question

17. Question

18. Question