WGU D522 (WEN1) TASK 1
PERFORMANCE ASSESSMENT EXAM
Incident Response & DNS Remediation
Python, GitLab, Device Inventory, Email, Helpdesk API & Evidence
Aligned with Current WGU D522 Course Competencies (2026/2027)
Western Governors University | Cybersecurity Education
Section Topic Questions
1 Incident Response Fundamentals Q1-Q12
2 DNS Fundamentals and Attack Vectors Q13-Q26
3 DNS Remediation Strategies Q27-Q40
4 Python Scripting for Incident Response Q41-Q56
5 GitLab Repository Management Q57-Q68
6 Device Inventory and Asset Management Q69-Q80
7 Helpdesk API Integration and Ticket Workflow Q81-Q90
8 Email Communication and Professional Documentation Q91-Q100
Total Questions: 100 | Cognitive Distribution: 25% Recall | 55% Application | 20% Analysis
Format: 75% Scenario-Based Application | 25% Direct Recall of Frameworks & Concepts
WGU D522 (WEN1) Task 1 Performance Assessment - 100 Questions & Answers Page 1
, SECTION 1: Incident Response Fundamentals
IR Lifecycle, NIST SP 800-61, Roles, & Communication — Q1 through Q12
Q1: A security analyst at a mid-sized financial firm receives an alert from the SIEM indicating unusual
outbound DNS queries to a known malicious domain. According to NIST SP 800-61 Revision 2, which phase of
the incident response lifecycle does this alert represent?
A. Preparation
B. Detection & Analysis [CORRECT]
C. Containment, Eradication & Recovery
D. Post-Incident Activity
Correct Answer: B
Rationale: NIST SP 800-61r2 defines four phases: Preparation, Detection & Analysis,
Containment/Eradication/Recovery, and Post-Incident Activity. The SIEM alert represents the Detection & Analysis
phase because the analyst has identified a potential indicator of compromise (IOC) and must now analyze the scope,
characteristics, and impact of the incident. The Preparation phase occurs before incidents and involves establishing tools,
policies, and team training. Containment/Eradication/Recovery occurs after analysis confirms an incident. Post-Incident
Activity involves lessons learned and documentation after the incident is resolved.
Q2: During an active incident, the incident response team identifies a compromised DNS server that is being
used to exfiltrate data. The team lead decides to immediately isolate the server from the network while
preserving its volatile memory for forensic analysis. This action falls under which IR phase?
A. Detection
B. Containment [CORRECT]
C. Eradication
D. Recovery
Correct Answer: B
Rationale: Containment involves isolating affected systems to prevent the incident from spreading while preserving
evidence for forensic analysis. Isolating the compromised DNS server from the network is a classic containment
action—it stops ongoing data exfiltration while volatile memory and disk artifacts are preserved. Eradication involves
removing the threat (malware, attacker access) after containment is in place. Recovery involves restoring systems to
normal operation. Detection involves identifying the incident; this has already occurred. WGU D522 Task 1 emphasizes
the proper sequence: contain first to limit damage, then eradicate, then recover.
Q3: A junior analyst on the incident response team is tasked with collecting volatile evidence from a
compromised Windows DNS server. Which of the following should be collected FIRST according to the Order
of Volatility?
A. Data stored on the local hard drive
B. Contents of RAM and running processes [CORRECT]
C. Remote registry and log files on a centralized logging server
D. Archived backup tapes stored offsite
Correct Answer: B
Rationale: The Order of Volatility (RFC 3227) directs that the most volatile evidence—CPU cache, RAM, running
processes, and network connections—be collected first, because they are lost when power is removed. RAM contains
active malware, encryption keys, network connections, and credentials that may not exist on disk. Hard drive data,
WGU D522 (WEN1) Task 1 Performance Assessment - 100 Questions & Answers Page 2
, registry files, and archived backups are far less volatile and can be collected later. WGU D522 Task 1 requires
documentation of evidence collection order to demonstrate forensic soundness and chain of custody compliance.
Q4: During an incident response, the analyst collects a DNS log file as evidence. To maintain proper chain of
custody, which information MUST be documented each time the evidence changes hands?
A. The file size and creation date only
B. Who collected/handled the evidence, when it was collected/transferred, where it is stored, and a
cryptographic hash (e.g., SHA-256) to verify integrity [CORRECT]
C. The original IP address of the source system
D. The antivirus version running on the collection system
Correct Answer: B
Rationale: Chain of custody documentation must record: (1) who collected and handled the evidence, (2) when it was
collected and each time it was transferred, (3) where it was stored, (4) why it was collected, and (5) a cryptographic hash
(typically SHA-256) computed at collection time and verified at each transfer to detect any modification. Without this
documentation, evidence may be inadmissible in legal proceedings and unreliable for internal disciplinary action. WGU
D522 Task 1 explicitly requires chain of custody documentation as part of the evidence retention requirements.
Q5: An organization categorizes an incident as a P1 (Priority 1) when it affects critical business functions or
involves sensitive customer data. A DNS poisoning attack is detected affecting all internal users' web
browsing. What is the appropriate severity classification and escalation?
A. P4 (Low)—notify the helpdesk via email within 24 hours
B. P1 (Critical)—activate the full IR team immediately, notify the CISO, executive leadership, and
legal/compliance stakeholders [CORRECT]
C. P3 (Medium)—assign a single analyst to investigate within 4 business hours
D. P2 (High)—notify only the IT operations team via the helpdesk ticketing system
Correct Answer: B
Rationale: A DNS poisoning attack affecting all internal users represents a P1 (Critical) incident because: (1) it impacts
critical business functions (web browsing, application access, email), (2) it can redirect users to malicious sites resulting
in credential theft, (3) it affects all users organization-wide, and (4) it may involve sensitive data exposure. P1 incidents
require immediate activation of the full IR team, notification of the CISO, executive leadership, and potentially
legal/compliance teams due to regulatory reporting obligations (e.g., GDPR, HIPAA, state breach notification laws).
WGU D522 Task 1 emphasizes appropriate escalation criteria and stakeholder communication.
Q6: During an incident, the IR team must communicate updates to multiple stakeholders. Which
communication approach aligns with best practice for executive leadership during an active incident?
A. Send raw packet captures and SIEM query syntax to the CEO via email
B. Provide concise executive summaries focused on business impact, scope, actions taken, and estimated
recovery time, avoiding technical jargon [CORRECT]
C. Wait until the incident is fully resolved before communicating any information to leadership
D. Post updates to the company's public-facing social media channels only
Correct Answer: B
Rationale: Executive communications during an active incident must be concise, business-focused, and free of
unnecessary technical jargon. Executives need to understand business impact (e.g., 'customer transactions are affected'),
scope (number of users/systems impacted), actions being taken by the IR team, and estimated recovery time. Raw packet
WGU D522 (WEN1) Task 1 Performance Assessment - 100 Questions & Answers Page 3
, captures and SIEM syntax are appropriate for technical IR team members, not executives. Waiting until full resolution
prevents leadership from making informed business decisions (e.g., customer notifications, regulatory reporting). Public
social media updates should follow approved crisis communication protocols. WGU D522 Task 1 requires professional
written communication tailored to the audience.
Q7: A security analyst is preparing the incident response toolkit and runbook for the team. According to NIST
SP 800-61, which of the following is the MOST important element of the Preparation phase?
A. Waiting for an incident to occur before determining response procedures
B. Establishing policies, training the IR team, building toolkits, and predefining communication and
escalation procedures before an incident occurs [CORRECT]
C. Purchasing new hardware only after an incident is detected
D. Documenting the incident only after recovery is complete
Correct Answer: B
Rationale: The Preparation phase is foundational—NIST SP 800-61 emphasizes establishing IR policies, training team
members, building and testing IR toolkits (forensic workstations, packet capture tools, scripts), defining roles and
responsibilities, and pre-establishing communication and escalation procedures BEFORE an incident occurs. An
organization that waits for an incident to occur before determining response procedures will suffer significant delays and
increased damage. WGU D522 Task 1 reflects this by requiring students to demonstrate preparation through documented
scripts, established workflows, and tested procedures.
Q8: After an incident is fully resolved, the IR team conducts a post-incident review meeting. What is the
primary purpose of the Post-Incident Activity phase according to NIST SP 800-61?
A. To assign blame to individuals who made mistakes during the response
B. To identify lessons learned, improve IR procedures, document the incident, update detection rules, and
prevent recurrence [CORRECT]
C. To immediately delete all evidence to free up storage space
D. To begin marketing the incident response to customers as a success story
Correct Answer: B
Rationale: The Post-Incident Activity phase (also called 'lessons learned') focuses on continuous improvement:
identifying what went well, what went poorly, and what could be improved. The team should hold a blameless
post-mortem (focusing on process, not individuals), update IR procedures and runbooks, add new detection rules based
on IOCs observed, update device inventory, document the incident for historical reference, and ensure evidence retention
complies with legal/regulatory requirements (typically 3-7 years). WGU D522 Task 1 requires post-incident
documentation that demonstrates this learning process.
Q9: An incident response team has identified that a compromised endpoint is beaconing to a C2 server via
DNS queries every 60 seconds. The team decides to block the malicious domain at the corporate DNS resolver
while preserving the endpoint for forensic analysis. This action is best described as:
A. Eradication—permanently removing the malware from the endpoint
B. Containment—limiting the spread and impact of the incident while preserving evidence [CORRECT]
C. Recovery—restoring normal operations
D. Preparation—preparing for future incidents
Correct Answer: B
Rationale: Blocking the malicious domain at the DNS resolver is a containment action—it stops the C2 communication
and limits further damage without altering or destroying evidence on the endpoint. The endpoint is preserved for forensic
WGU D522 (WEN1) Task 1 Performance Assessment - 100 Questions & Answers Page 4
PERFORMANCE ASSESSMENT EXAM
Incident Response & DNS Remediation
Python, GitLab, Device Inventory, Email, Helpdesk API & Evidence
Aligned with Current WGU D522 Course Competencies (2026/2027)
Western Governors University | Cybersecurity Education
Section Topic Questions
1 Incident Response Fundamentals Q1-Q12
2 DNS Fundamentals and Attack Vectors Q13-Q26
3 DNS Remediation Strategies Q27-Q40
4 Python Scripting for Incident Response Q41-Q56
5 GitLab Repository Management Q57-Q68
6 Device Inventory and Asset Management Q69-Q80
7 Helpdesk API Integration and Ticket Workflow Q81-Q90
8 Email Communication and Professional Documentation Q91-Q100
Total Questions: 100 | Cognitive Distribution: 25% Recall | 55% Application | 20% Analysis
Format: 75% Scenario-Based Application | 25% Direct Recall of Frameworks & Concepts
WGU D522 (WEN1) Task 1 Performance Assessment - 100 Questions & Answers Page 1
, SECTION 1: Incident Response Fundamentals
IR Lifecycle, NIST SP 800-61, Roles, & Communication — Q1 through Q12
Q1: A security analyst at a mid-sized financial firm receives an alert from the SIEM indicating unusual
outbound DNS queries to a known malicious domain. According to NIST SP 800-61 Revision 2, which phase of
the incident response lifecycle does this alert represent?
A. Preparation
B. Detection & Analysis [CORRECT]
C. Containment, Eradication & Recovery
D. Post-Incident Activity
Correct Answer: B
Rationale: NIST SP 800-61r2 defines four phases: Preparation, Detection & Analysis,
Containment/Eradication/Recovery, and Post-Incident Activity. The SIEM alert represents the Detection & Analysis
phase because the analyst has identified a potential indicator of compromise (IOC) and must now analyze the scope,
characteristics, and impact of the incident. The Preparation phase occurs before incidents and involves establishing tools,
policies, and team training. Containment/Eradication/Recovery occurs after analysis confirms an incident. Post-Incident
Activity involves lessons learned and documentation after the incident is resolved.
Q2: During an active incident, the incident response team identifies a compromised DNS server that is being
used to exfiltrate data. The team lead decides to immediately isolate the server from the network while
preserving its volatile memory for forensic analysis. This action falls under which IR phase?
A. Detection
B. Containment [CORRECT]
C. Eradication
D. Recovery
Correct Answer: B
Rationale: Containment involves isolating affected systems to prevent the incident from spreading while preserving
evidence for forensic analysis. Isolating the compromised DNS server from the network is a classic containment
action—it stops ongoing data exfiltration while volatile memory and disk artifacts are preserved. Eradication involves
removing the threat (malware, attacker access) after containment is in place. Recovery involves restoring systems to
normal operation. Detection involves identifying the incident; this has already occurred. WGU D522 Task 1 emphasizes
the proper sequence: contain first to limit damage, then eradicate, then recover.
Q3: A junior analyst on the incident response team is tasked with collecting volatile evidence from a
compromised Windows DNS server. Which of the following should be collected FIRST according to the Order
of Volatility?
A. Data stored on the local hard drive
B. Contents of RAM and running processes [CORRECT]
C. Remote registry and log files on a centralized logging server
D. Archived backup tapes stored offsite
Correct Answer: B
Rationale: The Order of Volatility (RFC 3227) directs that the most volatile evidence—CPU cache, RAM, running
processes, and network connections—be collected first, because they are lost when power is removed. RAM contains
active malware, encryption keys, network connections, and credentials that may not exist on disk. Hard drive data,
WGU D522 (WEN1) Task 1 Performance Assessment - 100 Questions & Answers Page 2
, registry files, and archived backups are far less volatile and can be collected later. WGU D522 Task 1 requires
documentation of evidence collection order to demonstrate forensic soundness and chain of custody compliance.
Q4: During an incident response, the analyst collects a DNS log file as evidence. To maintain proper chain of
custody, which information MUST be documented each time the evidence changes hands?
A. The file size and creation date only
B. Who collected/handled the evidence, when it was collected/transferred, where it is stored, and a
cryptographic hash (e.g., SHA-256) to verify integrity [CORRECT]
C. The original IP address of the source system
D. The antivirus version running on the collection system
Correct Answer: B
Rationale: Chain of custody documentation must record: (1) who collected and handled the evidence, (2) when it was
collected and each time it was transferred, (3) where it was stored, (4) why it was collected, and (5) a cryptographic hash
(typically SHA-256) computed at collection time and verified at each transfer to detect any modification. Without this
documentation, evidence may be inadmissible in legal proceedings and unreliable for internal disciplinary action. WGU
D522 Task 1 explicitly requires chain of custody documentation as part of the evidence retention requirements.
Q5: An organization categorizes an incident as a P1 (Priority 1) when it affects critical business functions or
involves sensitive customer data. A DNS poisoning attack is detected affecting all internal users' web
browsing. What is the appropriate severity classification and escalation?
A. P4 (Low)—notify the helpdesk via email within 24 hours
B. P1 (Critical)—activate the full IR team immediately, notify the CISO, executive leadership, and
legal/compliance stakeholders [CORRECT]
C. P3 (Medium)—assign a single analyst to investigate within 4 business hours
D. P2 (High)—notify only the IT operations team via the helpdesk ticketing system
Correct Answer: B
Rationale: A DNS poisoning attack affecting all internal users represents a P1 (Critical) incident because: (1) it impacts
critical business functions (web browsing, application access, email), (2) it can redirect users to malicious sites resulting
in credential theft, (3) it affects all users organization-wide, and (4) it may involve sensitive data exposure. P1 incidents
require immediate activation of the full IR team, notification of the CISO, executive leadership, and potentially
legal/compliance teams due to regulatory reporting obligations (e.g., GDPR, HIPAA, state breach notification laws).
WGU D522 Task 1 emphasizes appropriate escalation criteria and stakeholder communication.
Q6: During an incident, the IR team must communicate updates to multiple stakeholders. Which
communication approach aligns with best practice for executive leadership during an active incident?
A. Send raw packet captures and SIEM query syntax to the CEO via email
B. Provide concise executive summaries focused on business impact, scope, actions taken, and estimated
recovery time, avoiding technical jargon [CORRECT]
C. Wait until the incident is fully resolved before communicating any information to leadership
D. Post updates to the company's public-facing social media channels only
Correct Answer: B
Rationale: Executive communications during an active incident must be concise, business-focused, and free of
unnecessary technical jargon. Executives need to understand business impact (e.g., 'customer transactions are affected'),
scope (number of users/systems impacted), actions being taken by the IR team, and estimated recovery time. Raw packet
WGU D522 (WEN1) Task 1 Performance Assessment - 100 Questions & Answers Page 3
, captures and SIEM syntax are appropriate for technical IR team members, not executives. Waiting until full resolution
prevents leadership from making informed business decisions (e.g., customer notifications, regulatory reporting). Public
social media updates should follow approved crisis communication protocols. WGU D522 Task 1 requires professional
written communication tailored to the audience.
Q7: A security analyst is preparing the incident response toolkit and runbook for the team. According to NIST
SP 800-61, which of the following is the MOST important element of the Preparation phase?
A. Waiting for an incident to occur before determining response procedures
B. Establishing policies, training the IR team, building toolkits, and predefining communication and
escalation procedures before an incident occurs [CORRECT]
C. Purchasing new hardware only after an incident is detected
D. Documenting the incident only after recovery is complete
Correct Answer: B
Rationale: The Preparation phase is foundational—NIST SP 800-61 emphasizes establishing IR policies, training team
members, building and testing IR toolkits (forensic workstations, packet capture tools, scripts), defining roles and
responsibilities, and pre-establishing communication and escalation procedures BEFORE an incident occurs. An
organization that waits for an incident to occur before determining response procedures will suffer significant delays and
increased damage. WGU D522 Task 1 reflects this by requiring students to demonstrate preparation through documented
scripts, established workflows, and tested procedures.
Q8: After an incident is fully resolved, the IR team conducts a post-incident review meeting. What is the
primary purpose of the Post-Incident Activity phase according to NIST SP 800-61?
A. To assign blame to individuals who made mistakes during the response
B. To identify lessons learned, improve IR procedures, document the incident, update detection rules, and
prevent recurrence [CORRECT]
C. To immediately delete all evidence to free up storage space
D. To begin marketing the incident response to customers as a success story
Correct Answer: B
Rationale: The Post-Incident Activity phase (also called 'lessons learned') focuses on continuous improvement:
identifying what went well, what went poorly, and what could be improved. The team should hold a blameless
post-mortem (focusing on process, not individuals), update IR procedures and runbooks, add new detection rules based
on IOCs observed, update device inventory, document the incident for historical reference, and ensure evidence retention
complies with legal/regulatory requirements (typically 3-7 years). WGU D522 Task 1 requires post-incident
documentation that demonstrates this learning process.
Q9: An incident response team has identified that a compromised endpoint is beaconing to a C2 server via
DNS queries every 60 seconds. The team decides to block the malicious domain at the corporate DNS resolver
while preserving the endpoint for forensic analysis. This action is best described as:
A. Eradication—permanently removing the malware from the endpoint
B. Containment—limiting the spread and impact of the incident while preserving evidence [CORRECT]
C. Recovery—restoring normal operations
D. Preparation—preparing for future incidents
Correct Answer: B
Rationale: Blocking the malicious domain at the DNS resolver is a containment action—it stops the C2 communication
and limits further damage without altering or destroying evidence on the endpoint. The endpoint is preserved for forensic
WGU D522 (WEN1) Task 1 Performance Assessment - 100 Questions & Answers Page 4
