OSIR Practice Questions - OffSec Incident Responder (OSIR, IR-200) Exam - OSIR Practice Questions - OffSec Incident Responder (OSIR, IR-200) Exam

Question 1

Which definition of a 'cybersecurity incident' best aligns with NIST SP 800-61r2?

Any single failed login attempt against a corporate system A violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices Only confirmed malware infections on production servers An external vulnerability disclosed by a researcher in a CVE advisory

Correct Answer:

A violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices

Question 2

What are the four phases of the NIST SP 800-61r2 incident response lifecycle, in order?

Identify, Protect, Detect, Respond Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity Plan, Do, Check, Act Reconnaissance, Weaponization, Delivery, Exploitation

Correct Answer:

Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity

Question 3

Which activity belongs primarily to the Preparation phase of the NIST 800-61r2 lifecycle?

Isolating a compromised host from the network Building and training the CSIRT, drafting playbooks, and provisioning forensic tooling Wiping and reimaging a malware-infected workstation Documenting lessons learned in an after-action report

Correct Answer:

Building and training the CSIRT, drafting playbooks, and provisioning forensic tooling

Question 4

An analyst observes a port scan from an external IP against the public-facing web server but no exploitation has occurred. NIST 800-61r2 calls this kind of signal a:

Precursor Indicator Compromise event Eradication step

Correct Answer:

Precursor

Question 5

In ITIL incident management, how does an 'incident' differ from a 'problem'?

Incidents are always security-related; problems are operational An incident is an unplanned interruption or quality reduction; a problem is the underlying root cause that may produce one or more incidents A problem must be reported within 24 hours; an incident has no SLA Incidents are tracked in change management; problems are tracked in incident management

Correct Answer:

An incident is an unplanned interruption or quality reduction; a problem is the underlying root cause that may produce one or more incidents

Exam overview

About this Exam

Prepare with the OSIR Practice Questions - OffSec Incident Responder (OSIR, IR-200) Exam practice quiz. This question bank includes 100 questions covering incident, analyst, windows, splunk, and mitre. Use it to review important concepts, identify knowledge gaps, and build confidence for the related exam, course, or assessment.

More details

Additional Information

OSIR Practice Questions - OffSec Incident Responder (OSIR, IR-200) Exam

This practice set contains 100 questions from the matching question bank and focuses on incident, analyst, windows, splunk, and mitre. Work through each question carefully, review the provided solutions, and revisit topics that need more study before your next attempt.

This is an independent study resource intended for practice and review; it is not an official examination or an endorsement by any organization named in the title.

Quiz information

Frequently Asked Questions

The complete question count is available after full access is unlocked.

No fixed duration is currently configured for this quiz.

Question explanations are included where they are available in the quiz content, helping you review the reasoning after answering.

Yes. You can retake the practice test again as you continue studying during your available access period.

After your access is confirmed, you can continue into the complete practice exam from this quiz flow.

Unless explicitly stated otherwise, this page provides independent practice material for study and exam preparation and is not the official examination itself.

Correct Answer:

Correct Answer:

Correct Answer:

Correct Answer:

Correct Answer:

About this Exam

Additional Information

OSIR Practice Questions - OffSec Incident Responder (OSIR, IR-200) Exam

Frequently Asked Questions

Related Questions

BLET First Responder Practice Exam

Basic Incident Command System (ICS 200) Practice Exam

Comprehensive Emergency Medical Procedures and Anatomy for First Responders Practice Test

Canadian Red Cross Emergency Medical Responder Practice Exam

Certified First Responder (CFR) State Practice Test

CrowdStrike Certified Falcon Responder (CCFR) Practice Exam