Question 1

Integrated log files are ________ event logs from multiple IDSs.

Accepted Answer

A)  filtered 
B)  correlated 
C)  aggregated 
D)  All of the above 
A)  filtered 
B)  correlated 
C)  aggregated 
D)  All of the above C

Question 2

In a crisis, human cognition ________.

Accepted Answer

A)  is degraded 
B)  is enhanced 
C)  Both A and B 
D)  Neither A nor B 
A)  is degraded 
B)  is enhanced 
C)  Both A and B 
D)  Neither A nor B A

Question 3

International laws about cybercrime are fairly uniform.

Accepted Answer

A) True 
 B)False  False

Question 4

________ eliminates the problem of having to re-baseline the system to proper security levels.

Accepted Answer

A)  Using a disk image 
B)  Total software reinstallation 
C)  Both A and B 
D)  Neither A nor B 
A)  Using a disk image 
B)  Total software reinstallation 
C)  Both A and B 
D)  Neither A nor B

Question 5

Successful attacks are commonly called ________.

Accepted Answer

A)  security incidents 
B)  countermeasures 
C)  Both A and B 
D)  Neither A nor B 
A)  security incidents 
B)  countermeasures 
C)  Both A and B 
D)  Neither A nor B

Question 6

A(n) ________ is a professional who is trained to collect and evaluate computer evidence in ways that are likely to be admissible in court.

Accepted Answer

A)  expert witness 
B)  computer forensics expert 
C)  Both A and B 
D)  Neither A nor B 
A)  expert witness 
B)  computer forensics expert 
C)  Both A and B 
D)  Neither A nor B

Question 7

________ is the act of passing an incident to the CSIRT or business continuity team.

Accepted Answer

A)  Transference 
B)  Escalation 
C)  Delegation 
D)  Acceleration 
A)  Transference 
B)  Escalation 
C)  Delegation 
D)  Acceleration

Question 8

Which of the following is a function of IDSs?

Accepted Answer

A)  Strike-back 
B)  Automated analysis 
C)  Both A and B 
D)  Neither A nor B 
A)  Strike-back 
B)  Automated analysis 
C)  Both A and B 
D)  Neither A nor B

Question 9

Past judicial precedents constitute ________.

Accepted Answer

A)  case law 
B)  statutes 
C)  criminal law 
D)  All of the above 
A)  case law 
B)  statutes 
C)  criminal law 
D)  All of the above

Question 10

If it can be applied, the least-damaging recovery option is ________.

Accepted Answer

A)  restoration from backup tapes 
B)  total reinstallation 
C)  repair during continuing server operation 
D)  All of the above are about equally damaging 
A)  restoration from backup tapes 
B)  total reinstallation 
C)  repair during continuing server operation 
D)  All of the above are about equally damaging

Question 11

Getting a firm's IT back into operation is ________.

Accepted Answer

A)  IT disaster recovery 
B)  business continuity recovery 
C)  response 
D)  None of the above 
A)  IT disaster recovery 
B)  business continuity recovery 
C)  response 
D)  None of the above

Question 12

Hot sites ________.

Accepted Answer

A)  are more expensive than CDP 
B)  Lose less data during a disaster than CDP 
C)  Both A and B 
D)  Neither A nor B 
A)  are more expensive than CDP 
B)  Lose less data during a disaster than CDP 
C)  Both A and B 
D)  Neither A nor B

Question 13

A CSIRT should not include members from the legal department.

Accepted Answer

A) True 
 B)False

Question 14

Which of the following is not one of the three rules for apologies?

Accepted Answer

A)  Explain what happened. 
B)  Acknowledge responsibility and harm. 
C)  Use wording aimed at reducing lawsuits. 
D)  Explain what action will be taken to compensate victims, if any. 
A)  Explain what happened. 
B)  Acknowledge responsibility and harm. 
C)  Use wording aimed at reducing lawsuits. 
D)  Explain what action will be taken to compensate victims, if any.

Question 15

________ is concerned with the restarting of the day-to-day revenue generating operations of the firm.

Accepted Answer

A)  Business continuity planning 
B)  IT disaster recovery 
C)  Both A and B 
D)  Neither A nor B 
A)  Business continuity planning 
B)  IT disaster recovery 
C)  Both A and B 
D)  Neither A nor B

Question 16

Only an expert witness is allowed to interpret facts for juries.

Accepted Answer

A) True 
 B)False

Question 17

Once an attack has begun, a company should never allow the attacker to continue.

Accepted Answer

A) True 
 B)False

Question 18

A router can be a NIDS.

Accepted Answer

A) True 
 B)False

Question 19

The normal standard for deciding a case in ________ trials is a preponderance of the evidence.

Accepted Answer

A)  civil 
B)  criminal 
C)  Both A and B 
D)  Neither A nor B 
A)  civil 
B)  criminal 
C)  Both A and B 
D)  Neither A nor B

Question 20

Restoration from backup tapes is one way to move files to the backup site.

Accepted Answer

A) True 
 B)False

Integrated log files are ________ event logs from multiple IDSs.

In a crisis, human cognition ________.

International laws about cybercrime are fairly uniform.

________ eliminates the problem of having to re-baseline the system to proper security levels.

Successful attacks are commonly called ________.

A(n) ________ is a professional who is trained to collect and evaluate computer evidence in ways that are likely to be admissible in court.

________ is the act of passing an incident to the CSIRT or business continuity team.

Which of the following is a function of IDSs?

Past judicial precedents constitute ________.

If it can be applied, the least-damaging recovery option is ________.

Getting a firm's IT back into operation is ________.

Hot sites ________.

A CSIRT should not include members from the legal department.

Which of the following is not one of the three rules for apologies?

________ is concerned with the restarting of the day-to-day revenue generating operations of the firm.

Only an expert witness is allowed to interpret facts for juries.

Once an attack has begun, a company should never allow the attacker to continue.

A router can be a NIDS.

The normal standard for deciding a case in ________ trials is a preponderance of the evidence.

Restoration from backup tapes is one way to move files to the backup site.

The Threat Environment

Planning and Policy

Cryptography

Secure Networks

Access Control

Firewalls

Host Hardening

Application Security

Data Protection

Module A: Networking Concepts

Filters

Exam 10: Incident and Disaster Response

Integrated log files are ________ event logs from multiple IDSs.

In a crisis, human cognition ________.

International laws about cybercrime are fairly uniform.

________ eliminates the problem of having to re-baseline the system to proper security levels.

Successful attacks are commonly called ________.

A(n) ________ is a professional who is trained to collect and evaluate computer evidence in ways that are likely to be admissible in court.

________ is the act of passing an incident to the CSIRT or business continuity team.

Which of the following is a function of IDSs?

Past judicial precedents constitute ________.

If it can be applied, the least-damaging recovery option is ________.

Getting a firm's IT back into operation is ________.

Hot sites ________.

A CSIRT should not include members from the legal department.

Which of the following is not one of the three rules for apologies?

________ is concerned with the restarting of the day-to-day revenue generating operations of the firm.

Only an expert witness is allowed to interpret facts for juries.

Once an attack has begun, a company should never allow the attacker to continue.

A router can be a NIDS.

The normal standard for deciding a case in ________ trials is a preponderance of the evidence.

Restoration from backup tapes is one way to move files to the backup site.

The Threat Environment

Planning and Policy

Cryptography

Secure Networks

Access Control

Firewalls

Host Hardening

Application Security

Data Protection

Module A: Networking Concepts

Filters