Question 1

What are the six phases of the NIST SP 800-61 incident response lifecycle in order?

Accepted Answer

Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity.

Question 2

What is the PRIMARY purpose of the containment phase during incident response?

Accepted Answer

To limit the scope and magnitude of the incident and prevent further damage while preserving evidence for investigation.

Question 3

What distinguishes an 'event' from an 'incident' in security operations?

Accepted Answer

An event is any observable occurrence in a system or network, while an incident is an event that negatively affects the confidentiality, integrity, or availability of information assets.

Question 4

What is the correct order of evidence collection to maintain forensic integrity during an incident?

Accepted Answer

Collect evidence from most volatile to least volatile: CPU registers and cache, RAM, network connections, running processes, disk storage, then backup media.

Question 5

What is a Computer Security Incident Response Team (CSIRT) and its primary function?

Accepted Answer

A CSIRT is a designated group responsible for receiving, reviewing, and responding to computer security incidents, coordinating response efforts, and communicating with stakeholders.

CISSP Security Operations

Also Included in the Study Bundle

Practice Tests

Study Guides

Match Game

Try These Cards

Want to keep studying?

Related Study Decks

CISSP Asset Security

CISSP Cybersecurity Certification — Complete Bundle

CISSP IAM Controls

CISSP Network Security

CISSP Security & Risk Management

CISSP Security Architecture

Unlock the Full CISSP Cybersecurity Certification Study Bundle