KC-7 — Chapter 7 Knowledge Check
Questions and answer context for Chapter 7
Use this page after completing the chapter Knowledge Check. Each question is repeated so the answer and rationale retain their full instructional context.
Questions
Select the best answer for each question.
1. What is the key difference in mindset between threat hunting and incident response?
A. Threat hunting asks “Is an attacker here?”; incident response asks “What happened, and what must we do?”
B. They are identical disciplines
C. Incident response never uses telemetry
D. Threat hunting only occurs after an incident is confirmed
2. What does the Order of Volatility describe?
A. The order in which alerts should be investigated
B. The severity ranking of Wazuh rules
C. The sequence for collecting evidence, from most volatile (e.g., memory) to least volatile (e.g., archived logs)
D. The order Suricata rules are loaded
3. Why is a chain of custody important during an investigation?
A. It is only relevant for law enforcement
B. It documents who handled evidence and when, preserving its integrity and credibility
C. It replaces the need for cryptographic hashes
D. It has no practical value in enterprise incident response
4. Why should you compute a cryptographic hash of a memory image immediately after acquisition?
A. To compress the file
B. Hashing is only required for disk images, not memory
C. It speeds up the acquisition process
D. To create a verifiable record that proves the evidence has not been altered
5. Why should a memory image never be written to the same disk being investigated?
A. It has no effect on the investigation
B. It is required by WinPmem’s licensing
C. It risks overwriting other volatile or slack-space evidence not yet examined
D. It makes the AFF4 format invalid
6. What is “live response” in DFIR?
A. Collecting evidence from an actively running system
B. Restoring a system from backup
C. Writing a post-incident report
D. Updating Suricata rules after an incident
7. Why does effective incident reporting matter as much as the technical investigation itself?
A. It doesn’t — only the technical findings matter
B. Reports are only required for legal proceedings
C. Executive summaries replace the need for technical accuracy
D. Findings that cannot be clearly communicated to stakeholders have limited practical value
Answer Key
| Q | Answer | Why |
|---|---|---|
| 1 | A | Hunting asks whether an attacker is present; IR asks what happened and what to do. |
| 2 | C | Order of Volatility: collect the most volatile evidence (memory) first. |
| 3 | B | Chain of custody preserves evidence integrity and credibility. |
| 4 | D | An immediate hash proves the image was never altered. |
| 5 | C | Writing to the evidence disk risks destroying unexamined artifacts. |
| 6 | A | Live response collects evidence from a running system. |
| 7 | D | Findings that cannot be communicated have limited practical value. |