Deck 8: Reacting to a Cyber Incident: Communication and Incident Recovery

Question 1

Which of the following regulations does not address notification of individuals or a government entity in the event of a data breach?

A) CCPA
B) GDPR
C) PIPEDA
D) HIPAA

Answer 1

CCPA

Question 2

Tyrese has just been hired as a cybersecurity analyst at a major hospital in Colorado. Which of the following regulations might he need to be familiar with?

A) ICO
B) PIPEDA
C) HIPAA
D) CCPA

Answer 2

HIPAA

Question 3

Samuel works for a telecommunications provider in the United States. Which of the following regulations might he need to be familiar with?

A) HIPAA
B) Sarbanes-Oxley
C) GDPR
D) PIPEDA

Answer 3

Sarbanes-Oxley

Question 4

Lillith has just been hired to head up an organization's new cybersecurity division. In the initial stages of forming the division, she needs to find a good way to respond to incidents. Which of the following might be the best option in the event that she discovers an extensive APT?

A) Delay a response until enough cybersecurity employees can be hired, as the attackers have already been present for some time.
B) Quickly hire several new employees to address the issue.
C) Respond to the APT by herself.
D) Call an incident response provider.

Question 5

A growing social media company has decided to expand its physical presence into Europe after seeing users start to sign up for its service. It collects a lot of information about users and needs to know what the requirements are to protect the users' data. Which of the following should the company look to for this information?

A) PIPEDA
B) GDPR
C) EASR
D) GLBA

Question 6

A Silicon Valley startup has begun attracting users in Canada. Which of the following regulations should its legal department study to ensure that the company is abiding by any applicable laws?

A) PIPEDA
B) COPPA
C) CCPA
D) GDPR

Question 7

A company with operations in Europe has just experienced a breach of its customer data. Which of the following does the company need to notify under European Union regulations?

A) GDPR
B) FBI
C) ICO
D) HHS

Question 8

Which of the following is not one of the purposes of establishing a communication process and plan?

A) Limit communication to trusted parties.
B) Prevent inadvertent release of information.
C) Be completely transparent with the public.
D) Use a secure method of communication.

Question 9

Annya, a cybersecurity analyst, has just pulled a failed hard drive out of a system. She cannot seem to get any applications to overwrite the blocks on the drive with random data. Which of the following methods should she use to ensure the data on the drive is safe from being recovered by unauthorized parties?

A) Reimaging
B) Sanitization
C) Reconstruction
D) Secure disposal

Question 10

Alika has just finished eradicating a piece of malware from a computer system. Which of the following might she do next as part of the validation process?

A) Reimaging
B) Reconstruction
C) Patching
D) Secure erase

Question 11

Victoria, a cybersecurity analyst, has just disconnected a computer from the network after finding that it was infected with malware. Which of the following is the next task that she should attempt to perform with the system?

A) Containment
B) Eradication
C) Validation
D) Patching

Question 12

Elon has created a project to review the vulnerabilities in his organization. As the project wraps up, which of the following should be created?

A) Lessons learned report
B) Incident response plan
C) Change request
D) Incident summary report

Question 13

Patrik, a cybersecurity analyst, has just discovered a computer system infected with malware that appears to communicate with a command and control server. He doesn't believe there will be any negative consequences to shutting down communications between the computer and the command and control server, so he decides to redirect the communications to a sinkhole. Which of the following containment methods did Patrik choose to employ?

A) Segmentation
B) Isolation
C) Removal
D) Reverse engineering

Question 14

Amir has just received a user's computer that was found to have a malware infection. He has sanitized the hard drive but doesn't have a snapshot from which he can restore. Which of the following techniques might he choose to make the system functional again?

A) Reimaging
B) Schneier technique
C) Segmentation technique
D) Reconstruction

Question 15

Moira has discovered a compromised computer on her organization's network that is communicating with a command and control server. She believes that cutting off the connection to the command and control server may completely destroy the system. Which of the following containment techniques might she choose to use? (Choose two.)

A) Renovation
B) Segmentation
C) Removal
D) Reverse engineering
E) Isolation