CySA+ Incident Response Management: 114 practice questions

12 of the 114 Incident Response Management questions in the Certsqill CySA+ bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for CySA+? Take the free 5-min readiness check →

1. Contents of RAM: According to the order of volatility, which data source should be collected FIRST?

1. Contents of RAM (memory dump) ✓

   Correct. RAM (volatile memory) is the most volatile evidence source — it is completely lost when the system is powered off or rebooted. It contains running processes, network connections, encryption keys, and in-memory malware that may not exist on disk. It must be captured first.
2. Hard disk image

   Incorrect. The hard disk is non-volatile storage — its contents persist after power loss. While critical to collect, it is much less time-sensitive than RAM. Collecting the disk first would risk losing in-memory artifacts that may hold key forensic evidence.
3. System event logs stored in /var/log/

   Incorrect. Log files on disk are non-volatile and will persist after the system is powered off. They are important forensic artifacts but are lower priority than volatile memory in the collection sequence.
4. Network packet capture from the switch port

   Incorrect. Network captures are valuable for detecting active C2 or lateral movement, but they represent ongoing traffic — starting a capture can happen in parallel. The immediate priority on the live host is RAM, which will be destroyed if the machine is shut down or crashes.

RAM is the most volatile evidence and must be captured first on a live system before it is lost to power loss or reboot.

2. Isolate the server at the network layer using firewall: Which containment action should the analyst recommend

1. Isolate the server at the network layer using firewall rules or VLAN reassignment to block C2 communication while keeping the server operational ✓

   Correct. Network isolation blocks the C2 channel, preventing encryption trigger commands from reaching the ransomware while keeping the server operational for patient care. This directly addresses the constraint (cannot take offline) and the immediate threat (C2 communication enabling encryption).
2. Immediately shut down the server to prevent the ransomware encryption payload from executing

   Incorrect. Immediate shutdown violates the stated constraint — the server is required for patient care with a 4-hour RTO. Additionally, some ransomware variants trigger encryption on shutdown. Shutdown should only occur after failover is in place.
3. Run a full antivirus scan to remove the ransomware before it executes its payload

   Incorrect. AV scans are investigative and may not successfully remove the ransomware before it executes. The immediate priority is blocking the C2 channel that can trigger the encryption payload, not attempting removal while the server remains connected.
4. Take a full disk image of the server for forensic purposes before taking any containment action

   Incorrect. Evidence preservation is important but should not delay containment when the threat is active and imminent. A full disk image takes significant time, during which the ransomware could receive its encryption trigger. Containment (network isolation) comes before extended evidence collection.

Network-layer isolation blocks the C2 channel that would trigger encryption while keeping the server operational, satisfying both the containment and business continuity requirements.

3. Static analysis: Which analysis approach is MOST appropriate?

1. Static analysis — examine the file using a disassembler and strings extraction tool without executing it ✓

   Correct. Static analysis examines the file without executing it, eliminating execution risk. Techniques include strings extraction (URLs, IPs, file paths, registry keys embedded in the binary), file hash generation (VirusTotal lookup), PE header analysis (imports, sections, compilation artifacts), and disassembly. This safely reveals network IOCs and capabilities without malware detonation.
2. Dynamic analysis — execute the file in a dedicated malware sandbox and monitor system calls and network traffic

   Incorrect. Dynamic analysis requires executing the malware, even in a sandboxed environment. While sandboxes provide strong isolation, the question states the analyst wants to avoid 'risking infection of the analysis system.' Static analysis satisfies this constraint without detonation. Dynamic analysis is complementary but does not meet the stated requirement.
3. Behavioral analysis — deploy the file on an isolated test network VM and monitor for lateral movement

   Incorrect. Behavioral analysis is a form of dynamic analysis that also requires execution. Additionally, testing for lateral movement on a VM introduces risk of escape or unintended propagation. This approach does not meet the requirement to avoid risking infection.
4. Submit the file to the vendor's cloud-based threat intelligence portal and wait for the analysis report

   Incorrect. Submitting to a cloud portal detonates the file in the vendor's sandbox (dynamic analysis), which may be acceptable for non-sensitive files, but also risks submitting sensitive/internal malware to a third-party service. It is also passive and does not develop the analyst's own understanding of the file's capabilities.

Static analysis examines a malicious file without executing it, safely revealing IOCs and capabilities through strings, disassembly, and PE header inspection.

4. Hypothesis: PsExec or similar tools are being used: Which hunt hypothesis and data source combination is MOST

1. Hypothesis: PsExec or similar tools are being used for remote execution; Data: Windows Security Event ID 4688 (process creation) and 7045 (service installation) logs correlated with SMB authentication events ✓

   Correct. PsExec works by copying a service binary to the remote system (detected via service installation logs — Event ID 7045) and creates a remote process (Event ID 4688). Correlating these with SMB authentication events (4648, 4624 Type 3) identifies the lateral movement pattern. This directly targets the specified TTP.
2. Hypothesis: The software update mechanism is compromised; Data: DNS query logs for software vendor domains

   Incorrect. This hypothesis targets the initial access TTP (supply chain compromise), not the lateral movement TTP the question specifically asks about. DNS logs for software vendor domains would not detect PsExec-based lateral movement.
3. Hypothesis: Exfiltration is occurring; Data: NetFlow data showing large HTTPS transfers to cloud storage provider IP ranges

   Incorrect. This targets the exfiltration TTP, not lateral movement. Detecting lateral movement requires process and authentication event correlation, not NetFlow analysis of external connections.
4. Hypothesis: Scheduled tasks have been created for persistence; Data: Windows Task Scheduler logs and registry RunOnce key audit events

   Incorrect. This targets the persistence TTP, not lateral movement. While valuable for the overall hunt, it does not address the PsExec-based lateral movement technique specified in the question.

Detecting PsExec-based lateral movement requires correlating Windows Event ID 7045 (service install) and 4688 (process creation) with SMB authentication events.

5. Implement an escalation process that triggers automatic: Which lessons-learned output BEST addresses the root

1. Implement an escalation process that triggers automatic notifications to leadership when High or Critical vulnerabilities remain unpatched beyond their remediation SLA ✓

   Correct. The root cause was a process failure: a High-severity vulnerability exceeded its remediation SLA by 32 days without escalation or intervention. An automated SLA escalation process directly addresses this control gap by creating accountability and visibility before a breach occurs.
2. Increase the frequency of vulnerability scans from weekly to daily to detect new vulnerabilities faster

   Incorrect. The vulnerability was already in the backlog — it was known and unactioned. Faster scanning would not have changed the outcome; the vulnerability was already discovered. The root cause is the failure to remediate within SLA, not a failure of detection.
3. Deploy a next-generation endpoint detection and response platform to detect ransomware behavior earlier

   Incorrect. Improved EDR detection is a valid security enhancement but does not address the root cause. The root cause is the vulnerability management process failure (SLA breach). EDR improvements address detection and response, not vulnerability management process governance.
4. Implement immutable backups to reduce recovery time in future ransomware incidents

   Incorrect. Immutable backups improve recovery capability (RTO/RPO) and are a valuable resilience control, but they do not address why the vulnerability remained unpatched. This is a recovery-capability improvement, not a root-cause fix for the governance failure.

The root cause is the remediation SLA governance failure — the correct lessons-learned action is an escalation process to enforce SLA compliance before breaches occur.

6. To ensure the integrity and admissibility of evidence: Which is the PRIMARY purpose of maintaining chain of cu

1. To ensure the integrity and admissibility of evidence by documenting who had possession of it and when, preventing successful claims of tampering or contamination ✓

   Correct. Chain of custody documents every person who handled the evidence, timestamps, storage conditions, and transfers. This creates an unbroken record that enables the evidence to withstand legal challenge — if the chain of custody is broken, defense attorneys can argue the evidence was tampered with and have it excluded.
2. To create a backup record in case the drive is physically damaged during transport

   Incorrect. Data backup is the purpose of creating forensic images (using tools like FTK Imager or dd). Chain of custody is a legal documentation process, not a data protection mechanism.
3. To notify management of all security incidents involving storage media, as required by company policy

   Incorrect. Incident notification is a separate process (incident ticketing, management communication). Chain of custody is specifically about evidentiary integrity for legal proceedings, not internal notification.
4. To ensure the forensic analyst does not accidentally overwrite the drive during analysis

   Incorrect. Protection against accidental overwrite is the purpose of write blockers (hardware devices that prevent writes to the evidence drive) and working on forensic copies rather than original media. Chain of custody is an administrative/legal documentation process.

Chain of custody creates an unbroken record of evidence possession to ensure legal admissibility and defeat claims of tampering.

7. Medium severity: Which incident severity classification is MOST appropriate?

1. Medium severity — confirmed C2 communication indicates a real compromise, but limited blast radius due to workstation isolation and absence of lateral movement ✓

   Correct. The incident is confirmed (known C2 IP, multiple threat intel feed matches) but currently contained: the compromised workstation has no access to sensitive data or critical systems, and no lateral movement has been observed. Medium severity reflects a real, active threat that requires prompt response without triggering the highest-level response resources.
2. Low severity — since no sensitive data is at risk and no lateral movement has occurred, this is a routine endpoint cleanup task

   Incorrect. Confirmed C2 communication is never 'low severity.' An active C2 channel means the attacker has established persistent access and command capability. Even without current sensitive data access, the attacker could use this foothold for lateral movement, data staging, or infrastructure abuse. Immediate response is required.
3. Critical severity — any confirmed C2 communication requires immediate executive notification and full IR team activation

   Incorrect. Critical severity is appropriate when there is active data exfiltration, widespread compromise, or impact to critical business systems. A single isolated workstation with C2 communication but no lateral movement or data access does not meet the threshold for organization-wide Critical response. Over-escalation wastes resources and creates 'alert fatigue' for high-severity classifications.
4. Informational — the alert is from threat intelligence feeds, which have high false positive rates and require manual verification

   Incorrect. The alert matches multiple threat intelligence feeds (increasing confidence) and involves actual C2 communication — this is not merely informational. Informational classification is for events that require logging but no immediate action. Confirmed C2 requires active response.

Confirmed C2 on an isolated workstation with no lateral movement is Medium severity: real and requiring prompt response, but limited current blast radius.

8. pslist/pstree: Which combination of Volatility plugins would BEST help identify malicious in-memory activity?

1. pslist/pstree (identify processes and their parent-child relationships), malfind (identify injected code or suspicious memory regions with execute permissions), and netscan (identify active and closed network connections) ✓

   Correct. This combination addresses the key forensic questions: (1) pslist/pstree reveals suspicious processes and abnormal parent-child relationships (e.g., svchost without services.exe as parent), (2) malfind identifies memory regions with VAD (Virtual Address Descriptor) execute permissions that are not backed by a file on disk — the signature of process injection or reflective DLL loading, (3) netscan reveals active C2 connections that may not appear in netstat on the live system.
2. dumpfiles (extract files from memory), hivelist (list registry hives), and dlllist (list loaded DLLs)

   Incorrect. These plugins provide useful context but are not optimal for detecting injected/fileless malware. dumpfiles extracts file objects, hivelist shows registry structure, and dlllist shows loaded DLLs. Malfind specifically targets the execute+anonymous memory pattern of code injection. For fileless malware, malfind is the critical plugin.
3. strings (extract readable strings from memory dump) and vol.py info (display memory image metadata)

   Incorrect. While strings extraction can reveal IOCs, it produces enormous output requiring manual filtering and is not targeted at malware detection. vol.py info provides image metadata (OS version, build, time). This combination lacks the process analysis and code injection detection needed for fileless malware investigation.
4. cmdscan/consoles (review command history) and filescan (list file objects in memory)

   Incorrect. cmdscan and consoles recover command history executed in cmd.exe sessions — useful for post-exploitation command reconstruction but not for detecting fileless malware's in-memory code injection. filescan lists file objects; fileless malware by definition avoids file-backed artifacts.

pslist/pstree identifies process anomalies, malfind detects injected code regions (execute+anonymous memory), and netscan reveals C2 connections — the core fileless malware detection combination.

9. Immediately notify the legal team and HR before taking: Which action should the analyst take NEXT?

1. Immediately notify the legal team and HR before taking further investigative action, as insider threat investigations have employment law and evidence admissibility implications ✓

   Correct. Insider threat investigations involve employment law, privacy regulations, potential criminal referrals, and evidence admissibility requirements that vary by jurisdiction. Acting without legal and HR involvement risks: (1) inadmissible evidence due to improper collection, (2) employment law violations (surveillance without notice in some jurisdictions), (3) tipping off the subject prematurely, (4) civil liability. Legal should lead the investigation structure.
2. Immediately confront the suspected employee and request they explain the anomalous activity

   Incorrect. Confronting the subject without legal involvement is a serious error: (1) tipping off the subject may cause them to destroy evidence, (2) the conversation may be legally significant and require specific procedures, (3) the analyst lacks the authority to conduct employment investigations without HR/legal involvement.
3. Collect all available evidence independently and present findings to management before involving legal

   Incorrect. Independent collection without legal guidance may produce inadmissible evidence. Privacy laws, monitoring consent requirements, and evidence handling procedures must be legally validated before collection. Management notification before legal involvement bypasses the required legal framework.
4. Delete the evidence from the SIEM after documenting it, to protect employee privacy until legal approval is obtained

   Incorrect. Deleting evidence is never the correct action. Evidence preservation is mandatory even when legal clearance is pending. The analyst should preserve evidence without expanding the investigation scope until legal and HR are involved.

Insider threat investigations require immediate legal and HR involvement before further action — employment law, privacy regulations, and evidence admissibility all depend on proper procedural compliance.

10. Filter Event ID 4624: Which query logic BEST targets this behavior?

1. Filter Event ID 4624 (Type 3 network logons), group by Account Name, count distinct Workstation Names within a 10-minute window, alert when count > 3 for non-service accounts ✓

   Correct. This logic specifically targets the lateral movement pattern: (1) Event 4624 Type 3 = network authentication events (remote logons), (2) Grouping by Account Name identifies which account is authenticating, (3) Counting distinct destination workstations in a short window identifies rapid multi-host access, (4) Threshold of >3 hosts in 10 minutes reduces false positives while catching rapid lateral movement, (5) Excluding service accounts filters legitimate automated processes.
2. Filter Event ID 4625 (failed logons), group by Source IP, alert when count > 10 within 5 minutes

   Incorrect. Event 4625 (failed logons) from a single source is a brute force/password spray indicator, not lateral movement. Lateral movement using valid stolen credentials typically produces successful logons (4624), not failures. High failure counts indicate credential guessing, not lateral movement.
3. Filter Event ID 4672 (special privilege logon), alert when any account receives special privileges

   Incorrect. Event 4672 fires when a privileged account logs on — it indicates privilege usage but does not specifically detect lateral movement. High-privilege accounts legitimately trigger 4672 on their own systems. This query would generate excessive false positives without multi-host correlation.
4. Filter all Event IDs where Source IP is not in the approved IP range, alert on any match

   Incorrect. An IP range filter would require maintaining an accurate approved IP list (operationally complex) and would miss lateral movement where the attacker uses corporate IP ranges — which is the typical case, since the attacker is operating from a compromised internal host.

Detecting lateral movement: filter successful network logons (Event 4624 Type 3), group by account, count distinct destination hosts in a short window — alert when a non-service account accesses >3 hosts in 10 minutes.

11. Defense evasion and impact preparation: An EDR platform generates multiple alerts on a Windows server over 3 m

1. Defense evasion and impact preparation — disabling recovery mechanisms (shadow copies, backups, recovery mode) before encryption to maximize damage and prevent victim recovery ✓

   Correct. These three actions are standard ransomware pre-encryption preparation: (1) vssadmin delete shadows — eliminates VSS shadow copies that would enable file recovery, (2) wbadmin delete backup — destroys Windows backup catalog, (3) bcdedit /set recoveryenabled No — disables Windows Recovery Environment. Together they eliminate all native recovery paths. MITRE ATT&CK: T1490 (Inhibit System Recovery).
2. Lateral movement — the ransomware is propagating from this server to other systems using backup administrative tools

   Incorrect. vssadmin, wbadmin, and bcdedit are Windows recovery management tools, not lateral movement tools. Lateral movement involves authenticating to other systems (PsExec, WMI, SMB). These actions operate locally on the single server.
3. Reconnaissance — the ransomware is identifying backup systems to target in a follow-up attack

   Incorrect. Reconnaissance involves gathering information about the environment. These three commands are destructive actions (deleting shadow copies, disabling backup) rather than information gathering. The reconnaissance phase would typically precede these actions.
4. Persistence — the ransomware modifies boot configuration to ensure it survives system reboots

   Incorrect. While bcdedit can modify boot settings, in this context it is disabling the Recovery Environment — an impact-preparation action. Persistence mechanisms would add startup entries (Run keys, services, scheduled tasks) to re-execute the malware on reboot. Disabling recovery mode prevents recovery, not ensures malware persistence.

Deleting shadow copies (vssadmin), disabling backup (wbadmin), and disabling recovery mode (bcdedit) constitute MITRE T1490 (Inhibit System Recovery) — pre-encryption impact preparation.

12. Remove the web shell and malicious cron job: Which sequence of actions BEST represents a complete and correct

1. Remove the web shell and malicious cron job, patch the exploited vulnerability, scan all systems sharing the same image for the same compromise, rebuild the server from a known-good baseline if full confidence in clean state cannot be achieved ✓

   Correct. Complete eradication: (1) Remove identified malicious artifacts (web shell, cron job), (2) Patch the exploited vulnerability to prevent re-exploitation, (3) Hunt for the same IOCs across other systems (the attacker may have spread), (4) Rebuild from known-good baseline if artifact removal confidence is low — especially for production servers where stealth persistence mechanisms may remain undetected.
2. Restore the server from the most recent backup and reconnect it to the network

   Incorrect. Restoring from backup alone is insufficient eradication if: (1) the backup was taken after the compromise (restores the web shell), (2) the exploited vulnerability is not patched (immediate re-exploitation), (3) other systems haven't been checked for the same compromise. Eradication must include patching and IOC sweeping.
3. Change all passwords and SSL certificates on the compromised server and reconnect it to the network

   Incorrect. Password and certificate rotation are important steps but do not constitute eradication. The web shell and malicious cron job are still present. Without removing the attack artifacts and patching the vulnerability, reconnecting the server immediately re-exposes it.
4. Format the server hard drive and consider the incident closed

   Incorrect. Formatting the drive removes the compromise but: (1) doesn't patch the vulnerability (re-exploitation after rebuild is likely), (2) destroys forensic evidence needed for lessons learned and potential legal action, (3) doesn't address the possibility of other compromised systems. Eradication must be followed by post-incident activities.

Complete eradication: remove artifacts, patch the exploited vulnerability, sweep other systems for the same IOCs, and rebuild from known-good baseline if full confidence in clean state is uncertain.

Other CySA+ domains

• Security Operations — 181 questions →
• Vulnerability Management — 132 questions →
• Reporting and Communication — 72 questions →
• All 499 CySA+ questions →