Incident Response
27 practice items · needed by 5 roles
Easy 5Medium 8Hard 14
Practice questions
- Cloud key pushed to a public repomedium
- Hotfix keeps disappearinghard
- First move in a post-deploy outagehard
- Outage that will not endhard
- A production KMS key scheduled for deletionhard
- Fixing alert fatigue with SLOshard
- Service collapses again after recoveryhard
- Why blameless postmortems?easy
- What MTTR measureseasy
- Mitigate firsteasy
- The incident commandermedium
- Backups that survive ransomwareeasy
- Why chain of custody matterseasy
- NIST incident response lifecyclemedium
- Containing a hijacked Microsoft 365 accountmedium
- What EDR host isolation doesmedium
- What evidence to collect firstmedium
- File integrity alert on a web servermedium
- Artefacts of PsExec lateral movementhard
- First move on an encrypting hosthard
- Evicting a Golden Ticket attackerhard
- Password reset did not stop the attackerhard
- An impossible timelinehard
- Exfiltration before encryptionhard
- Web server spawning a shellhard
- GDPR breach notification deadlinehard
- p99 doubled right after a releasemedium