Question 1

Companies should realize that prosecution for possible incidents is a public process.

Accepted Answer

A) True 
 B)False  True

Question 2

The main attraction of ________ is that they provide highly specific information about what happened on a particular host computer.

Accepted Answer

A)  HIDSs 
B)  stand-alone NIDSs 
C)  router NIDSs 
D)  switch NIDSs 
A)  HIDSs 
B)  stand-alone NIDSs 
C)  router NIDSs 
D)  switch NIDSs A

Question 3

One important factor in pushing many organizations to cloud-based hosting is the lower cost than many other alternatives.

Accepted Answer

A) True 
 B)False  True

Question 4

A backup facility is usually on the same company premises.

Accepted Answer

A) True 
 B)False

Question 5

Successful attacks are commonly called ________.

Accepted Answer

A)  minor incidents 
B)  security incidents 
C)  live tests 
D)  major incidents 
A)  minor incidents 
B)  security incidents 
C)  live tests 
D)  major incidents

Question 6

Companies do not need to update their IDS attack signatures as it is done automatically.

Accepted Answer

A) True 
 B)False

Question 7

Which of the following is NOT a factor of cloud-based hosting?

Accepted Answer

A)  Lower costs 
B)  Better disaster recovery 
C)  Increased reliability 
D)  Lessened scalability 
A)  Lower costs 
B)  Better disaster recovery 
C)  Increased reliability 
D)  Lessened scalability

Question 8

________ punishments may result in jail time.

Accepted Answer

A)  Criminal law 
B)  Civil law 
C)  Forensics 
D)  Local law 
A)  Criminal law 
B)  Civil law 
C)  Forensics 
D)  Local law

Question 9

________ looks specifically at the technical aspects of how a company can get IT back into operation.

Accepted Answer

A)  A business continuity plan 
B)  Business management 
C)  An IT disaster recovery 
D)  A live test 
A)  A business continuity plan 
B)  Business management 
C)  An IT disaster recovery 
D)  A live test

Question 10

Each monitoring device has a software agent that collects event data.

Accepted Answer

A) True 
 B)False

Question 11

Which of the following is beyond the abilities of CSIRTs?

Accepted Answer

A)  Minor incidents 
B)  False alarms 
C)  Disasters 
D)  Major incidents 
A)  Minor incidents 
B)  False alarms 
C)  Disasters 
D)  Major incidents

Question 12

Which of the following is NOT a priority at the beginning of an incident?

Accepted Answer

A)  Detection 
B)  Analysis 
C)  Escalate 
D)  Recovery 
A)  Detection 
B)  Analysis 
C)  Escalate 
D)  Recovery

Question 13

It's important for a company to realize that a system needs to be better than before an attack so that the attacker cannot come back in.

Accepted Answer

A) True 
 B)False

Question 14

In the United States, the main federal law regarding hacking is U.S. ________.

Accepted Answer

A)  18 U.S.C. § 1030 
B)  18 U.S.C. § 2511 
C)  18 U.S.C. § 18 
D)  18 U.S.C. § 1020 
A)  18 U.S.C. § 1030 
B)  18 U.S.C. § 2511 
C)  18 U.S.C. § 18 
D)  18 U.S.C. § 1020

Question 15

Which of the following is NOT one of the four major functions of an IDS?

Accepted Answer

A)  Logging 
B)  Automated analysis 
C)  Administrator actions 
D)  Prevention 
A)  Logging 
B)  Automated analysis 
C)  Administrator actions 
D)  Prevention

Question 16

Repair during continuing server operation is ________.

Accepted Answer

A)  dangerous 
B)  rarely risky 
C)  reliable 
D)  effective 
A)  dangerous 
B)  rarely risky 
C)  reliable 
D)  effective

Question 17

In crises, communication within a company is usually enhanced.

Accepted Answer

A) True 
 B)False

Question 18

According to the Federal Bureau of Investigation, about ________ of concentrated attacks are successful.

Accepted Answer

A)  1 percent 
B)  5 to 10 percent 
C)  12 percent 
D)  22 percent 
A)  1 percent 
B)  5 to 10 percent 
C)  12 percent 
D)  22 percent

Question 19

________ initiate legal proceedings in civil cases.

Accepted Answer

A)  Defendants 
B)  Prosecutors 
C)  Plaintiffs 
D)  Lawyers 
A)  Defendants 
B)  Prosecutors 
C)  Plaintiffs 
D)  Lawyers

Question 20

The Network Time Protocol allows a type of synchronization.

Accepted Answer

A) True 
 B)False

Companies should realize that prosecution for possible incidents is a public process.

The main attraction of ________ is that they provide highly specific information about what happened on a particular host computer.

One important factor in pushing many organizations to cloud-based hosting is the lower cost than many other alternatives.

A backup facility is usually on the same company premises.

Successful attacks are commonly called ________.

Companies do not need to update their IDS attack signatures as it is done automatically.

Which of the following is NOT a factor of cloud-based hosting?

________ punishments may result in jail time.

________ looks specifically at the technical aspects of how a company can get IT back into operation.

Each monitoring device has a software agent that collects event data.

Which of the following is beyond the abilities of CSIRTs?

Which of the following is NOT a priority at the beginning of an incident?

It's important for a company to realize that a system needs to be better than before an attack so that the attacker cannot come back in.

In the United States, the main federal law regarding hacking is U.S. ________.

Which of the following is NOT one of the four major functions of an IDS?

Repair during continuing server operation is ________.

In crises, communication within a company is usually enhanced.

According to the Federal Bureau of Investigation, about ________ of concentrated attacks are successful.

________ initiate legal proceedings in civil cases.

The Network Time Protocol allows a type of synchronization.

The Threat Environment

Planning and Policy

Cryptography

Secure Networks

Access Control

Firewalls

Host Hardening

Application Security

Data Protection

Module a Networking Concepts

Filters

Exam 10: Incident and Disaster Response

Companies should realize that prosecution for possible incidents is a public process.

The main attraction of ________ is that they provide highly specific information about what happened on a particular host computer.

One important factor in pushing many organizations to cloud-based hosting is the lower cost than many other alternatives.

A backup facility is usually on the same company premises.

Successful attacks are commonly called ________.

Companies do not need to update their IDS attack signatures as it is done automatically.

Which of the following is NOT a factor of cloud-based hosting?

________ punishments may result in jail time.

________ looks specifically at the technical aspects of how a company can get IT back into operation.

Each monitoring device has a software agent that collects event data.

Which of the following is beyond the abilities of CSIRTs?

Which of the following is NOT a priority at the beginning of an incident?

It's important for a company to realize that a system needs to be better than before an attack so that the attacker cannot come back in.

In the United States, the main federal law regarding hacking is U.S. ________.

Which of the following is NOT one of the four major functions of an IDS?

Repair during continuing server operation is ________.

In crises, communication within a company is usually enhanced.

According to the Federal Bureau of Investigation, about ________ of concentrated attacks are successful.

________ initiate legal proceedings in civil cases.

The Network Time Protocol allows a type of synchronization.

The Threat Environment

Planning and Policy

Cryptography

Secure Networks

Access Control

Firewalls

Host Hardening

Application Security

Data Protection

Module a Networking Concepts

Filters