❓ Week 6 Knowledge Check – Incident Response & SIEM Mastery

What is the first step in the NIST incident response lifecycle?

Continuous monitoring replaces the need for incident response.

What is the main function of a Security Information and Event Management (SIEM) system?

What happens during the “Containment” phase of incident response?

Name one key benefit of using threat intelligence in continuous monitoring.

Why is it critical to conduct a lessons-learned meeting after an incident?

Match the phase to its purpose

A SIEM alert shows repeated failed login attempts from an internal IP. What’s your immediate response phase?

Which of the following is a popular open-source SIEM tool?

What’s a key reason organizations use SIEMs in real-time detection?