Deck 5: Incidence Response: Reaction, Recovery, and Maintenance

Question 1

When an incident violates civil or criminal law and the crime is not directed at or does not affect the national infrastructure,the FBI may be able to assist the organization as effectively as state or local agencies can.

Answer 1

False

Question 2

Everyone should know how to handle an incident,not just the CISO and systems administrators.

Answer 2

True

Question 3

A(n)____ has the first person call certain other people on the roster,who in turn call other people,and so on.

A)sequential roster
B)hierarchical roster
C)alert roster
D)alert message

Answer 3

B

Question 4

____ is the coherent application of methodical investigatory techniques to solve crime cases.

A)Forensics
B)Alarm Compaction
C)Signature matching
D)Scanning

Question 5

The ____ is a scripted description of the incident and consists of just enough information so that each responder knows what portion of the IR plan to implement without impeding the notification process.

A)sequential roster
B)hierarchical roster
C)alert roster
D)alert message

Question 6

The first and most important part of ____ is the identification and collection of evidentiary material without damage or modification of its content.

A)site policy
B)disaster recovery
C)Alarm Compaction
D)computer forensics

Question 7

The training plan should not include references to the provisioning of actual or contingent credentials needed to execute the containment and recovery steps in the plan.

Question 8

All changes proposed to the IR plan must be coordinated with the CPMT so that changes to the IR plan stay aligned with the use of other contingency planning documents used in the company.

Question 9

If properly structured and conducted,the ____ can have a positive effect on the organization's IR capacity and employee confidence in responding to incidents.

A)black bag operation
B)system backup
C)system maintenance
D)AAR

Question 10

____ is information,graphics,images,or any other physical or electronic item that could have value as evidence of guilt (or innocence)in a legal proceeding,whether criminal or civil.

A)Chain of custody
B)Evidentiary material
C)Computer forensics
D)False positive material

Question 11

If poorly handled,the ____ can actually reduce the organization's ability to react because individuals,especially users,may prefer to sweep potential incidents under the rug rather than risk improperly responding and having to face "the firing squad."

A)AAR
B)sequential roster
C)after-action review
D)system log

Question 12

A(n)____ requires that a contact person call each and every person on the roster.

A)sequential roster
B)hierarchical roster
C)alert roster
D)root roster

Question 13

____ is the determination of the initial flaw or vulnerability that allowed the incident to occur by examining the systems,networks,and procedures that were involved.

A)Hash analysis
B)Root cause analysis
C)black bag analysis
D)containment analysis

Question 14

An effective ____ plan guides an organization's response when an incident occurs,enables the prompt recovery of normal operations,and assists in the smooth transition to disaster recovery or business continuity plans when needed.

A)sequential roster
B)hierarchical
C)Incident Response
D)war game

Question 15

The first step in acquiring computer evidence is the establishment of ____ procedures.

A)search and seizure
B)after-action
C)incidence response
D)disaster recovery

Question 16

____ involves the preservation,identification,extraction,documentation,and interpretation of computer media for evidentiary and/or root cause analysis.

A)Alarm Compaction
B)Alarm filtering
C)Computer forensics
D)Enticement

Question 17

Rehearsals that closely match reality are called ____.

A)virtual reality
B)computer games
C)forensics
D)war games

Question 18

AARs are conducted with all participants in attendance.

Question 19

At the end of the incident review,the ____ serves as a review tool,allowing the team to examine how the team responded to the incident.

A)sequential roster
B)AAR
C)hierarchical roster
D)chain of custody

Question 20

A(n)____ is a document containing contact information for the individuals that need to be notified in the event of an actual incident.

A)sequential roster
B)hierarchical roster
C)alert roster
D)root roster

Question 21

The immediate determination of the scope of the breach of confidentiality,integrity,and availability of information and information assets is called ______________________________.

Question 22

Match each statement with an item below.


-Provides information on the type,scope,and extent of damage caused by the incident.

A)IR plan
B)After-action review
C)Interview
D)Incident
E)System log
F)Forensics
G)War game
H)Computer forensics
I)Hashing

Question 23

Incident ____________________ strategies focus on two tasks: stopping the incident and recovering control of the affected systems.

Question 24

A search in which the suspect never knows a search occurred,because the scene is restored to its original state is called a ____.

A)white bag operation
B)blue bag operation
C)green bag operation
D)black bag operation

Question 25

Match each statement with an item below.


-Process by which a mathematical algorithm turns a variable-length input into a fixed-length output.

A)IR plan
B)After-action review
C)Interview
D)Incident
E)System log
F)Forensics
G)War game
H)Computer forensics
I)Hashing

Question 26

The ____ has a bank fraud investigation unit,and the Securities and Exchange Commission has investigation and fraud control units as well.

A)FBI
B)U.S.Secret Service
C)CIA
D)U.S.Treasury Department

Question 27

Match each statement with an item below.


-Can provide training for future generations of SIRT professionals.

A)IR plan
B)After-action review
C)Interview
D)Incident
E)System log
F)Forensics
G)War game
H)Computer forensics
I)Hashing

Question 28

The ____ handles computer crimes that are categorized as felonies.

A)FBI
B)U.S.Secret Service
C)U.S.Treasury Department
D)CIA

Question 29

Once an incident has been contained,and system control has been regained,incident ____________________ can begin.

Question 30

The ____ investigates crimes involving U.S.currency,counterfeiting,and certain cases involving credit card fraud and identity theft.

A)FBI
B)U.S.Secret Service
C)U.S.Treasury Department
D)CIA

Question 31

Match each statement with an item below.


-Combines skills from a number of disciplines,yet has its roots in two - computer science and criminal justice.

A)IR plan
B)After-action review
C)Interview
D)Incident
E)System log
F)Forensics
G)War game
H)Computer forensics
I)Hashing

Question 32

Match each statement with an item below.


-Can be used to best assess how the incident occurred and what vulnerabilities were exploited to cause the damage assessed.

A)IR plan
B)After-action review
C)Interview
D)Incident
E)System log
F)Forensics
G)War game
H)Computer forensics
I)Hashing

Question 33

The ____ is a log of everyone who has had access to or possession of evidentiary material from its collection to its presentation during legal proceedings.

A)system log
B)signature log
C)chain of custody
D)attack stimulus

Question 34

Match each statement with an item below.


-Involves three groups of stakeholders: end users,help desk personnel,and systems administrators.

A)IR plan
B)After-action review
C)Interview
D)Incident
E)System log
F)Forensics
G)War game
H)Computer forensics
I)Hashing

Question 35

____ is a process by which a mathematical algorithm turns a variable-length input into a fixed-length output.

A)Compaction
B)Hashing
C)Clustering
D)Filtering

Question 36

Match each statement with an item below.


-Designed to stop the incident,mitigate its effects,and provide information that facilitates recovering from the incident.

A)IR plan
B)After-action review
C)Interview
D)Incident
E)System log
F)Forensics
G)War game
H)Computer forensics
I)Hashing

Question 37

Match each statement with an item below.


-May increase in scope or severity to the point that the IR plan cannot adequately handle it.

A)IR plan
B)After-action review
C)Interview
D)Incident
E)System log
F)Forensics
G)War game
H)Computer forensics
I)Hashing

Question 38

The ____________________ entails a detailed examination of the events that occurred from first detection to final recovery.

Question 39

Match each statement with an item below.


-Uses a subset of plans that are in place to create a realistic test environment.

A)IR plan
B)After-action review
C)Interview
D)Incident
E)System log
F)Forensics
G)War game
H)Computer forensics
I)Hashing

Question 40

Once an actual incident has been confirmed and properly classified,the IR team moves from the detection phase to the ____________________ phase.

Question 41

List seven best practices,provided by CERT,for responding to an intrusion.

Question 42

What are some of the questions that should be asked when reviewing the incidence response plan?

Question 43

What are the steps involved in analyzing evidentiary material?

Question 44

What are the key steps in the Protect and Forget reaction strategy?

Question 45

Discuss five key steps in the Apprehend and Prosecute reaction strategy.

Question 46

List five incident containment strategies.

Question 47

In formulating an incident response strategy,what are some of the factors that influence the organization's decision process?

Question 48

What factors should be considered when determining the costs associated with an incident?

Question 49

What is the three-step methodology followed by computer forensics?

Question 50

What conditions must be met before a private organization can search an employee's computer?