Cybersecurity Week 6 – Quiz – Student Portal

Which of the following is the first phase in the NIST Incident Response Lifecycle?

Detection & Analysis

Correct Incorrect Correct answer

Containment

Correct Incorrect Correct answer

Preparation

Correct Incorrect Correct answer

Eradication

Correct Incorrect Correct answer

What is the main purpose of containment in an incident response process?

Rebuild the system

Correct Incorrect Correct answer

Prevent future incidents

Correct Incorrect Correct answer

Stop the spread of the attack

Correct Incorrect Correct answer

Restore lost data

Correct Incorrect Correct answer

Which command in PowerShell is used to disable an Active Directory user account?

Disable-ADUser

Correct Incorrect Correct answer

Disable-Account

Correct Incorrect Correct answer

Remove-ADAccount

Correct Incorrect Correct answer

Disable-ADAccount

Correct Incorrect Correct answer

Which of the following would best help in detecting a compromised admin account?

Antivirus

Correct Incorrect Correct answer

Email Filter

Correct Incorrect Correct answer

SIEM logs and user behavior analysis

Correct Incorrect Correct answer

Task Scheduler

Correct Incorrect Correct answer

What does RCA stand for in incident response?

Response and Cleanup Audit

Correct Incorrect Correct answer

Root Cause Analysis

Correct Incorrect Correct answer

Rapid Control Assessment

Correct Incorrect Correct answer

Remote Command Access

Correct Incorrect Correct answer

What tool is typically used to capture and analyze network packets during investigation?

Wireshark

Correct Incorrect Correct answer

Notepad++

Correct Incorrect Correct answer

Power BI

Correct Incorrect Correct answer

Active Directory

Correct Incorrect Correct answer

Under GDPR, how soon must you report a data breach to the supervisory authority?

7 days

Correct Incorrect Correct answer

24 hours

Correct Incorrect Correct answer

72 hours

Correct Incorrect Correct answer

Immediately

Correct Incorrect Correct answer

What is the goal of the eradication phase in the IR lifecycle?

Inform users about the breach

Correct Incorrect Correct answer

Recover from the incident

Correct Incorrect Correct answer

Remove the attacker’s presence and backdoors

Correct Incorrect Correct answer

Replace hardware components

Correct Incorrect Correct answer

What log file in Windows provides detailed security events including login attempts?

System Log

Correct Incorrect Correct answer

Application Log

Correct Incorrect Correct answer

Security Log

Correct Incorrect Correct answer

Event Installer Log

Correct Incorrect Correct answer

Which tool can help automate endpoint isolation during incident containment?

MS Paint

Correct Incorrect Correct answer

EDR/AV (e.g., Defender ATP, CrowdStrike)

Correct Incorrect Correct answer

WinRAR

Correct Incorrect Correct answer

CMD

Correct Incorrect Correct answer

What would be considered an Indicator of Compromise (IOC)?

High CPU usage

Correct Incorrect Correct answer

Suspicious file hash

Correct Incorrect Correct answer

Empty Recycle Bin

Correct Incorrect Correct answer

Open Word Document

Correct Incorrect Correct answer

A USB device infecting an offline system is an example of:

Web attack

Correct Incorrect Correct answer

Lateral movement

Correct Incorrect Correct answer

Initial compromise

Correct Incorrect Correct answer

Reconnaissance

Correct Incorrect Correct answer

What type of incident would phishing most likely lead to?

Data center outage

Correct Incorrect Correct answer

Compromised credentials

Correct Incorrect Correct answer

Hardware failure

Correct Incorrect Correct answer

Application bug

Correct Incorrect Correct answer

What is the purpose of an IR playbook?

Monitor internet usage

Correct Incorrect Correct answer

Provide step-by-step guidance during incidents

Correct Incorrect Correct answer

Manage project timelines

Correct Incorrect Correct answer

Install operating systems

Correct Incorrect Correct answer

Which of the following is NOT a typical component of an incident report?

Timeline of events

Correct Incorrect Correct answer

Executive salary details

Correct Incorrect Correct answer

Systems affected

Correct Incorrect Correct answer

Response actions

Correct Incorrect Correct answer

After recovery, which activity ensures the same incident won’t happen again?

Containment

Correct Incorrect Correct answer

Reporting

Correct Incorrect Correct answer

Lessons Learned Review

Correct Incorrect Correct answer

User Notification

Correct Incorrect Correct answer

What role typically communicates with media and executives during a major incident?

Incident Handler

Correct Incorrect Correct answer

Forensics Analyst

Correct Incorrect Correct answer

Communication Lead

Correct Incorrect Correct answer

Network Engineer

Correct Incorrect Correct answer

Which law governs the protection of health information in the United States?

GDPR

Correct Incorrect Correct answer

PECA

Correct Incorrect Correct answer

HIPAA

Correct Incorrect Correct answer

NIST

Correct Incorrect Correct answer

What containment technique disables a user’s login ability during an attack?

Blocking IP address

Correct Incorrect Correct answer

Disabling USB ports

Correct Incorrect Correct answer

User account disablement

Correct Incorrect Correct answer

Data encryption

Correct Incorrect Correct answer

Which tool provides a central dashboard to correlate logs for incident detection?

Windows Task Manager

Correct Incorrect Correct answer

Splunk or ELK Stack

Correct Incorrect Correct answer

Registry Editor

Correct Incorrect Correct answer

Disk Cleanup

Correct Incorrect Correct answer

Cybersecurity Week 6 – Quiz

Cybersecurity Week 6 – Quiz

Quiz Summary

Information

Results

Results

Categories

1. Question

2. Question

3. Question

4. Question

5. Question

6. Question

7. Question

8. Question

9. Question

10. Question

11. Question

12. Question

13. Question

14. Question

15. Question

16. Question

17. Question

18. Question

19. Question

20. Question