Explain Incident Response and Monitoring Concepts

12A

Incident Response

p.296

Quiz 12A

1. Incident Response Processes p.296
2. Preparation p.298
3. Detection p.300
4. Analysis p.301
5. Containment p.302
6. Eradication and Recovery p.303
7. Lessons Learned p.304
8. Testing and Training p.306
9. Threat Hunting p.307

12B

Digital Forensics

p.308

Quiz 12B

1. Due Process and Legal Hold p.308
2. Acquisition p.309
3. System Memory Acquisition p.311
4. Disk Image Acquisition p.311
5. Preservation p.313
6. Reporting p.314

12C

Data Sources

p.315

Quiz 12C

1. Data Sources, Dashboards, and Reports p.315
2. Log Data p.317
3. Host Operating System Logs p.318
4. Application and Endpoint Logs p.319
5. Network Data Sources p.321
6. Packet Captures p.322
7. Metadata p.324

12D

Alerting and Monitoring Tools

p.325

Quiz 12D

1. Security Information and Event Management p.325
2. Alerting and Monitoring Activities p.326
3. Alert Tuning p.328
4. Monitoring Infrastructure p.329
5. Monitoring Systems and Applications p.330
6. Benchmarks p.332