Deck 7: Reacting to a Cyber Incident: Impact and Forensics

Question 1

What is the term for the amount of time an incident interrupts normal business processes?

Answer 1

Downtime

Question 2

The majority of U.S. organizations are considered "cyber-ready" to defend themselves against attacks.

Answer 2

False

Question 3

Which U.S. Cabinet Secretary introduced many Americans to the concepts of known knowns and known unknowns?

A) Alexander Haig
B) Colin Powell
C) Condoleezza Rice
D) Donald Rumsfeld

Answer 3

D

Question 4

A person's name, Social Security number, driver's license number, bank account number, and passport number are examples of ______________.

Question 5

Which phase of a cyber incident response plan has the goal of permitting affected systems back into the production environment?

A) Analysis
B) Recovery
C) Follow-up
D) Containment

Question 6

A ____________ is a more targeted version of a brute force attack that uses placeholders for characters in certain positions of the password; its goal is to speed up the cracking process by reducing the number of potential candidates that must be created.

Question 7

Which is the following is not considered an element of a forensics kit?

A) Write blocker
B) IDS
C) digital forensic workstation
D) cables and drive adapters

Question 8

What type of attack conducts a statistical analysis on passwords and then uses it to create a mask in an attempt to break the largest number of possible passwords.

A) Mask attack
B) Brute force attack
C) Dictionary attacks
D) Rule attack

Question 9

The primary tool in a forensics kit is a _______________, which is specially configured to perform forensics activities.

Question 10

Which of the following forms in a forensics kit helps to document that evidence was under strict control at all times?

A) Incident form
B) Chain of custody form
C) Incident response from
D) Call/escalation list