SANS FOR508 exam questions with answers

SANS FOR508 exam questions with answers |\ |\ |\ |\ |\




Dwell Time - CORRECT ANSWERS ✔✔The time an attacker has
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\


remained undetected within a network. An important metric to
|\ |\ |\ |\ |\ |\ |\ |\ |\


track as it directly correlates with the ability of an attacker to
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\ |\ |\


accomplish their objectives. |\ |\




Breakout Time - CORRECT ANSWERS ✔✔Time is takes an intruder
|\ |\ |\ |\ |\ |\ |\ |\ |\


to begin moving laterally once they have an initial foothold in
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\ |\ |\


the network. |\




Main Threat Actors - CORRECT ANSWERS ✔✔APT (Nation State
|\ |\ |\ |\ |\ |\ |\ |\ |\


Actors)
Organized Crime |\




Hacktivists


NIST - CORRECT ANSWERS ✔✔US National Institute for Standards
|\ |\ |\ |\ |\ |\ |\ |\


and Technology
|\ |\




Six-Step Incident Response Process - CORRECT ANSWERS ✔✔1:
|\ |\ |\ |\ |\ |\ |\ |\


Preparation
2: Identification
|\




3: Containment and Intelligence Development
|\ |\ |\ |\




4: Eradication and Remediation
|\ |\ |\




5: Recovery
|\




6: Follow-up
|\

, Six-Step - Preparation - CORRECT ANSWERS ✔✔Incident response
|\ |\ |\ |\ |\ |\ |\


methodologies emphasize preparation-not only establishing a
|\ |\ |\ |\ |\ |\ |\


response capability so the organization is ready to respond to
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\


incidents but also preventing incidents by ensuring that systems,
|\ |\ |\ |\ |\ |\ |\ |\


networks, and applications are sufficiently secure.
|\ |\ |\ |\ |\ |\




Six-Step - Identificatoin - CORRECT ANSWERS ✔✔Identification is
|\ |\ |\ |\ |\ |\ |\ |\


triggered by a suspicious event. This could be from a security
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\ |\


appliance, a call to the help-desk, or the result of something |\ |\ |\ |\ |\ |\ |\ |\ |\ |\ |\


discovered via threat hunting. Event validation should occur and |\ |\ |\ |\ |\ |\ |\ |\ |\


a decision made as to the severity of the finding (not valid
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\ |\ |\


events lead to a full incident response). Once an incident
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\


response has begun, this phase is used to better understand the
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\ |\


findings and begin scoping the network for additional
|\ |\ |\ |\ |\ |\ |\ |\


compromise.


Six Step - Containment and Intelligence development - CORRECT
|\ |\ |\ |\ |\ |\ |\ |\ |\


ANSWERS ✔✔In this phase, the goal is to rapidly understand the
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\ |\


adversary and begin crafting a containment strategy. Responders
|\ |\ |\ |\ |\ |\ |\


must identify the initial vulnerability or exploit, how the attackers
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\


are maintaining persistence and laterally moving in the network,
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\


and how command and control is being accomplished. in
|\ |\ |\ |\ |\ |\ |\ |\ |\


conjunction with the previous scoping phase, responders will |\ |\ |\ |\ |\ |\ |\ |\


work to have a complete picture of the attack and often
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\ |\


implement changes to the environment to increase host and |\ |\ |\ |\ |\ |\ |\ |\ |\


network visibility. Threat intelligence is one of the key products of
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\


the IP team during this phase.
|\ |\ |\ |\ |\ |\




Six Step - Eradication and Remediation - CORRECT ANSWERS
|\ |\ |\ |\ |\ |\ |\ |\ |\


✔✔Arguably the most important phase of the process, |\ |\ |\ |\ |\ |\ |\ |\