Detection Engineering and Incident Response Quiz Answer Key
Table of Contents
Return to the Detection Engineering and Incident Response Quiz
Use this key after you answer every question. Correct the reason for each missed item before you retake the quiz or start the capstone.
Answer Key
- B. A telemetry contract defines meaning and limits before analysis.
- A. An Analytic holds platform-specific detection logic under a Detection Strategy.
- C. ATT&CK v18 introduced the current defensive object model and deprecated Data Sources.
- C. Approved inventory work should not match the Office-parent encoded-command rule.
- B. The source proves use of an authentication path, not the human behind the session.
- B. The event directly records the host behavior.
- A. The card makes authority, evidence risk, rollback, and verification visible.
- B. Password reset alone does not remove sessions or delegated application grants.
- B. Parent, script, destination, user, and approval context support a separate benign workflow.
- C. Recovery needs technical and business validation.
Score and Review
| Score | Required next action |
|---|---|
| 9 to 10 | Record corrections for missed items, then start the capstone |
| 7 to 8 | Revisit each missed lesson, correct every missed reason, and retake the quiz from a clean copy. Start the capstone only after the retest reaches 9 out of 10 |
| 0 to 6 | Repeat Lessons 1 through 6 with the sample timeline, correct every missed reason, and retake the quiz. Reach 9 out of 10 before the capstone |
Troubleshooting
- Two answers seem plausible: Choose the one supported by direct evidence and bounded claims.
- A framework term is unclear: Return to the official source linked in the related lesson.
- Your reason differs from the key: Identify which fact changes the decision.
Verify Your Review
- All ten questions have recorded answers and reasons
- Missed items link to a specific lesson
- Revised answers explain the evidence change
- The final score reaches 9 out of 10 before capstone work
Complete the Detection Engineering and Incident Response Capstone after you pass the quiz gate.
