Questions

Answer the following questions to test your knowledge of this chapter:

1. During a security incident, a team member was able to refer to known documentation and databases of attack vectors to aid the response. What is this an example of?
   1. Event classification
   2. A false positive
   3. A false negative
   4. A true positive
2. During a security incident, a team member responded to a SIEM alert and successfully stopped an attempted data exfiltration. What can be said about the SIEM alert?
   1. It's a false positive.
   2. It's a false negative.
   3. It's a true positive.
   4. It's a true negative.
3. During a security incident, a senior team leader coordinated with members already dealing with a breach. They were told to concentrate their efforts on a new threat. What process led to the team leader's actions?
   1. Preparation
   2. Analysis
   3. Triage event
   4. Pre-escalation tasks
4. A CSIRT team needs to be identified, including leadership with a clear reporting and escalation process. At what stage...