Deck 7: Reacting to a Cyber Incident: Impact and Forensics

Question 1

An online retailer has just discovered a data breach of the system used to store all of the data for shipments of products, including tracking numbers, date shipped, customer names, and addresses. Which of the following has the company failed to protect?

A) PRI
B) PII
C) PCI
D) PHI

Answer 1

PII

Question 2

A startup company has invented a new IoT device and stored the design documents on an internal network share. Which of the following types of data are they trying to protect?

A) PII
B) PHI
C) IP
D) PCI

Answer 2

IP

Question 3

Van has been tasked with designing a fault-tolerant system for a critical application. Which of the following is the biggest concern about the design of this system?

A) Downtime
B) Recovery time
C) Data integrity
D) System process criticality

Answer 3

Downtime

Question 4

Tyrese, a cybersecurity analyst, is performing an audit of user accounts when he discovers a handful of accounts that do not appear to represent actual employees at his organization. As he continues to investigate, he finds that the accounts were created around four months ago and only connect to resources from outside the network. Which of the following might he have discovered?

A) APT
B) DDoS
C) Zero day
D) Ransomware

Question 5

Bettye manages a server for which a major vulnerability was recently reported in one of the services that her company uses. However, a patch is not currently available to fix the vulnerability, so she needs to ensure that the firewall and other protections in place will prevent a threat actor from exploiting the vulnerability. Which of the following describes the type of vulnerability on the server she manages?

A) APT
B) DDoS
C) Ransomware
D) Zero day

Question 6

Alisi, a cybersecurity manager, has found that a former employee was engaging in illegal activities online;she must report these activities to local law enforcement authorities. She locks the employee's computer in a closet to which only she and two of her peers have access. Which of the following should be created as part of the documentation for this incident?

A) PII form
B) PHI tracker
C) Incident response plan
D) Chain of custody

Question 7

Dharma manages a Linux server and wants to ensure that none of the users on the system have common passwords that would be in a standard password dictionary. Which of the following would best help accomplish her goal?

A) Rainbow tables
B) Password dictionary
C) Chained credentials
D) Crack list

Question 8

Kevin is working the after-hours shift in the NOC and receives an alert that there has been a potential intrusion into one of the servers. He pulls out the incident response plan and sees that the first step is to notify the on-call manager. Where might he find that information?

A) Chain of custody
B) Escalation list
C) Incident form
D) Crime tape

Question 9

Dion is developing an application that will allow users to create their own passwords. He then needs to store that information in a database to be used when the user attempts to log in again. Which of the following provides the strongest option for Dion to accomplish this task?

A) SHA-256
B) MD4
C) MD5
D) SHA-512

Question 10

Boris, a cybersecurity analyst, has just received a client's hard drive that needs a forensic analysis. He needs to ensure that the data on the drive maintains its integrity and that no unallocated blocks are changed so he can attempt to undelete files on the drive. Which of the following tools would be most useful as part of his analysis?

A) Multiport hub
B) Write blocker
C) Universal hard drive adapter kit
D) Tamper-evident tape

Question 11

Takara is building a digital forensics workstation. She needs the ability to connect to PATA and SATA devices for forensic analysis. Which of the following tools might best fit her needs?

A) Multiport hub
B) Universal hard drive adapter kit
C) Write blocker
D) Firewire hard drive controller

Question 12

Dahlia has just been hired as a new cybersecurity manager at an organization. Up until now, the organization has not had any formal procedures in place to handle events such as malware or data breaches. Dahlia would like to ensure that everyone follows the same procedures when responding to these events. Which of the following should she create?

A) IRP
B) DRP
C) IP
D) CDP