Exam 18: Incident Handling

A(n) ____________________ in a computer-security environment is an event that tests the security solutions in place on a network or, in the case of a stand-alone machine, on that machine itself.

Defaced-page incidents result in loss of revenue, reputation, and morale of a company.

____________________ tools monitor the events of attacks made on specific computers, such as password cracking or executing unauthorized programs.

Statistics reveal that most incidents of fraud involve "outside" individuals.

____ tools record unusual activities performed by users, such as repeated attempts to connect to the server or attempts to access restricted resources.

The skills represented in an emergency response team always belong to the IT department.

What are the key phases of incident handling?

In UNIX and Linux, ____________________ is a dumping ground for automated CRON jobs, as well as various logged functions by applications that do not maintain their own log files.

What are some of the most common events that may indicate an attack in progress?

This type of incident means an attacker has hacked your Web server.

The most common incidents that affect network security are attacks from malicious code and ____.

____ attacks send input data of a greater size than the capacity of an unchecked variable in the server application.

What are some of the most common types of incidents that can occur on a network or a computer?

____ attacks send a large quantity of packets to a server so that resources are overutilized.

How one approaches incident detection can seriously impact the number and kinds of incidents that are detectable.

____________________ is the most basic form of a DoS attack. Large numbers of requests are sent to the server. This results in the slowing down or failure of the network.

The chief difference between a worm and a virus is that ____________________ replicate in a network.

Organizations that handle and document incidents may be less likely to have repeat occurrences.

What are some of the reasons to develop effective incident handling policies?