Exam 11: Contingency Planning and Networking Incident Response

Match each item with a statement below. a.RAID Level 0 f.RAID Level 5 b.RAID Level 1 g.RAID Level 6 c.RAID Level 2 h.RAID Level 7 d.RAID Level 3 i.RAID Level 10 e.RAID Level 4 -Uses byte-level striping of data

Incident ____ is the process of evaluating organizational events, determining which events are possible incidents, also called incident candidates, and then determining whether or not the incident candidate is an actual incident or a nonevent, also called a false positive incident candidate.

____________________ are the contractual documents guaranteeing certain minimum levels of service provided by vendors.

List the four integrated contingency planning (CP) components.

Match each item with a statement below. a.RAID Level 0 f.RAID Level 5 b.RAID Level 1 g.RAID Level 6 c.RAID Level 2 h.RAID Level 7 d.RAID Level 3 i.RAID Level 10 e.RAID Level 4 -A specialized form of disk striping with parity; is not widely used

Which team is responsible for conducting the BIA?

The ____ review entails a detailed examination of the events that occurred from first detection to final recovery.

In some organizations, which two plans are considered to be one plan, known as the Business Resumption Plan?

____ planning ensures that critical business functions can continue if a disaster occurs.

Describe the two criteria that may cause a disaster occurrence.

A(n) ____ is a detailed description of the activities that occur during an attack, including the preliminary indications of the attack as well as the actions taken and the outcome.

Describe the three forms of cloud computing.

The identification of an incident begins with the ____________________ - that is, the circumstances that cause the IR team to be activated and the IR plan to be initiated.

Compare the protect and forget strategy with the apprehend and prosecute strategy.

Match each item with a statement below. a.RAID Level 0 f.RAID Level 5 b.RAID Level 1 g.RAID Level 6 c.RAID Level 2 h.RAID Level 7 d.RAID Level 3 i.RAID Level 10 e.RAID Level 4 -A proprietary variation on RAID 5 in which the array works as a single virtual drive

According to D. L. Pipkin, ____ is a definite indicator of an actual incident.

Which backup method allows for easy full-system restorations (no shuffling through tapes with partial backups on them)?

NAS works well with real-time applications because of the latency of the communication methods.

Incident response focuses on immediate response to small-scale events.

____ clustering is a more complex model in which all members of a cluster simultaneously provide application services.