D340 Cyber Defense and Countermeasures - Set 4 - Part 1

Correct Answer: Preparation, identification, containment, eradication, recovery, lessons learned

The widely used incident response lifecycle progresses through preparation, identification, containment, eradication, recovery, and lessons learned.

Correct Answer: Capability built beforehand determines how well every later phase executes

Tools, training, playbooks, and logging must exist before an incident. Capability cannot be created during the crisis when it is most needed.

Correct Answer: Limiting the incident's spread and damage while preserving evidence

Containment stops the incident from spreading further while retaining forensic evidence needed to understand scope and root cause.

Correct Answer: Short-term stops immediate damage; long-term applies durable fixes pending full eradication

Short-term containment quickly isolates affected systems, while long-term containment applies more durable measures allowing business operation until full eradication.

Correct Answer: Volatile memory evidence would be lost

Shutting down destroys RAM contents including running processes, network connections, and encryption keys that may be essential forensic evidence.

Correct Answer: Collect the most volatile evidence first before it disappears

Evidence should be collected from most to least volatile, since memory and network state vanish quickly while disk contents persist longer.

Correct Answer: Documented record of who handled evidence and when

Chain of custody documents every transfer and handling of evidence, establishing its integrity and admissibility in legal proceedings.

Correct Answer: It preserves the original unaltered while analysis occurs on a copy

Analysis alters data. Working from a verified bit-for-bit image preserves the original evidence intact and allows analysis to be repeated or independently verified.

Correct Answer: Proving evidence has not been altered since collection

Computing a hash at collection and again later proves the evidence is unchanged, since any modification would produce a different digest.

Correct Answer: Removing the attacker's access, tools, and persistence from the environment

Eradication removes malware, backdoors, unauthorized accounts, and other attacker footholds so the threat cannot simply resume after recovery.

Correct Answer: Restoring without closing the entry point invites immediate reinfection

If the vulnerability or credential that enabled entry remains, the attacker simply returns through the same path after systems are restored.

Correct Answer: The backup may contain the attacker's malware or backdoors

Backups created after initial compromise may include attacker persistence mechanisms, so determining the compromise date is essential to selecting a clean restore point.

Correct Answer: The duration between initial compromise and detection

Dwell time measures how long an attacker operated undetected. Longer dwell time generally means greater access, more data lost, and more complex remediation.

Correct Answer: Attackers commonly harvest credentials for continued access

Credential theft is a standard attacker objective, so a comprehensive reset denies continued access through captured passwords, tokens, and keys.

Correct Answer: Restoring systems to normal operation with confidence they are clean

Recovery restores services and validates that systems are clean and monitored, often with heightened observation to confirm the threat has not returned.

Correct Answer: It detects whether the attacker regains or retains access

Attackers frequently attempt to return through remaining footholds, so elevated monitoring during the period after recovery is essential to confirm eradication succeeded.

Correct Answer: Identifying improvements to prevent recurrence and improve response

The lessons learned review examines what happened, what worked, and what failed, producing concrete improvements to controls, detection, and procedures.

Correct Answer: Promptly after resolution while details remain fresh

Conducting the review soon after resolution captures accurate recollection and maintains momentum for implementing the identified improvements.

Correct Answer: A documented procedure for handling a specific incident type

Playbooks provide step-by-step guidance for common incident types, ensuring consistent, complete response without improvising under pressure.

Correct Answer: Clear responsibility prevents confusion and duplicated or missed actions

Defined roles such as incident commander, technical lead, and communications lead ensure decisions are made authoritatively and nothing is overlooked.