PDF 200-201 Study Guide

Delivery is the fourth phase of the cyber kill chain, which is a model to describe the stages of a cyberattack. Delivery refers to the transmission of the weaponized payload to the target system, such as via email attachments, web links, USB drives, or network connections. Delivery does not necessarily imply successful installation or execution of the payload, which are subsequent phases of the kill chain. References := Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) - Cisco, page 31.

 When a server is experiencing high CPU and memory load, the first step is to identify the processes that are consuming the most resources. The command “ps -ef” is used to display information about all the running processes, including their IDs, memory and CPU usage, and the commands that started them. This allows the engineer to pinpoint which processes are responsible for the high load and take appropriate action, such as terminating unnecessary processes or optimizing resource usage345. References: Various resources on server management and troubleshooting recommend using the “ps -ef” command as a starting point for investigating high resource usage on servers

An attack surface is the sum of all the points where an attacker can try to enter or extract data from an environment. It includes all the hardware, software, network, and human components that are exposed to potential threats. An attack vector is the path or means by which an attacker can exploit a vulnerability in the attack surface. It describes the type, source, and technique of an attack, such as phishing, malware, denial-of-service, etc. References := Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) v1.0, Module 1: Security Concepts, Lesson 1.1: The CIA Triad and Security Concepts, Topic 1.1.3: Threats, Vulnerabilities, and Exploits

• According to NIST SP800-61, the incident response lifecycle consists of four phases: Preparation, Detection and Analysis, Containment, Eradication and Recovery, and Post-Incident Activity.
• When a SOC team member checks the Cisco Firepower Manager dashboard for further isolation actions, they are working within the Eradication and Recovery phase.
• This phase focuses on removing the threat from the environment and recovering affected systems to normal operations.

References

• NIST SP800-61 Computer Security Incident Handling Guide
• Incident Response Phases Explained
• Role of SOC in Incident Response