Deck 18: Incident Handling

Question 1

Organizations that handle and document incidents may be less likely to have repeat occurrences.

Answer 1

True

Question 2

Defaced-page incidents result in loss of revenue, reputation, and morale of a company.

Answer 2

True

Question 3

Statistics reveal that most incidents of fraud involve "outside" individuals.

Answer 3

False

Question 4

The skills represented in an emergency response team always belong to the IT department.

Question 5

How one approaches incident detection can seriously impact the number and kinds of incidents that are detectable.

Question 6

The most common incidents that affect network security are attacks from malicious code and ____.

A)inside jobs
B)denial-of-service attacks
C)network flooding
D)password cracking

Question 7

This type of incident means an attacker has hacked your Web server.

A)Malicious code
B)Defaced pages
C)Errors and omissions
D)Fraud and theft

Question 8

____ attacks send a large quantity of packets to a server so that resources are overutilized.

A)Defaced pages
B)Intrusion
C)Errors and omissions
D)Denial-of-service

Question 9

____ attacks send input data of a greater size than the capacity of an unchecked variable in the server application.

A)Network flooding
B)Stack error
C)Buffer overflow
D)Errors and omissions

Question 10

____ tools record unusual activities performed by users, such as repeated attempts to connect to the server or attempts to access restricted resources.

A)System-monitoring
B)User-analysis
C)Network analysis
D)Log-analysis

Question 11

A(n) ____________________ in a computer-security environment is an event that tests the security solutions in place on a network or, in the case of a stand-alone machine, on that machine itself.

Question 12

____________________ is the most basic form of a DoS attack. Large numbers of requests are sent to the server. This results in the slowing down or failure of the network.

Question 13

____________________ tools monitor the events of attacks made on specific computers, such as password cracking or executing unauthorized programs.

Question 14

In UNIX and Linux, ____________________ is a dumping ground for automated CRON jobs, as well as various logged functions by applications that do not maintain their own log files.

Question 15

The chief difference between a worm and a virus is that ____________________ replicate in a network.

Question 16

What are some of the most common events that may indicate an attack in progress?

Question 17

What are some of the reasons to develop effective incident handling policies?

Question 18

What are some of the most common types of incidents that can occur on a network or a computer?

Question 19

What are the key phases of incident handling?