Reference no: EM133893606
Questions
1. Describe the functions of the following tools:
FireEye EX, IronScales, ProofPoint
FireEye ETP
FireEye NX, Palo Alto, Cisco Umbrella, Cisco Sourcefire
FireEye HX, Eg: MDE, Sentinel, Crowdstrike, Carbon Black
2. What are the first steps that we must take when reviewing an alert?
3. Describe the malware infection life cycle in your own words, how does it relate to the intrusion kill chain model?
4. What is MITRE ATT&CK?
5. What is OODA LOOP?
6. What is data exfiltration and how can it be prevented?
7. What happens when a callback is established on a system and what steps are required to remediate the situation?
8. When investigating an incident, what do we document?
9. In a situation where all SIEM tools are down or not available, where do we go to start investigation on a potential intrusion?
10. What is a process?
11. How are IPS tools different from IDS tools?