ch 10 CIS 3361

What is the final stage of the business impact analysis

Identify recovery priorities for system resources.

List the seven steps of the incident recovery process, according to Donald Pipkin.

Identify the vulnerabilities. Address the safeguards. Evaluate monitoring capabilities. Improve detection and reporting . Restore the data from backups. Restore the services and processes in use. Continuously monitor the system. Restore the confidence.

A hot site is a fully configured computing facility that includes all services, communications links, and physical plant operations.

True

In which type of site are no computer hardware or peripherals provided?

cold site

The group of senior managers and project members organized to conduct and lead all CP efforts is known as the __________.

crisis management planning team (CMPT)

In __________ testing of contingency plans, the individuals follow each and every procedure, including interruption of service, restoration of data from backups, and notification of appropriate individuals.

full-interruption

Which of the following determines the scope of the breach of confidentiality, integrity, and availability of information and information assets?

incident damage assessment

The __________ plan is a detailed set of processes and procedures that anticipate, detect, and mitigate the effects of an unexpected event that might compromise information resources and assets.

incident response ,IR

Which of the following is a responsibility of the crisis management team?

keeping the public informed about the event and the actions being taken

The Hartford insurance company estimates that, on average, __________ businesses that don't have a disaster plan go out of business after a major loss like a fire, a break-in, or a storm.

over 40 percent of

The __________ is the point in time before a disruption or system outage to which business process data can be recovered after the outage, given the most recent backup copy of the data.

recovery point objective (RPO)

The maximum amount of time that a system resource can remain unavailable before there is an unacceptable impact on other system resources and supported business processes is known as __________.

recovery time objective (RTO)

In which contingency plan testing strategy do individuals participate in a role-playing exercise in which the CP team is presented with a scenario of an actual incident or disaster and expected to react as if it had occurred?

simulation

Which of the following is NOT a major component of contingency planning?

threat assessment

Which of the following is a "possible" indicator of an actual incident, according to Donald Pipkin?

unusual consumption of computing resources

Which of the following is a definite indicator of an actual incident, according to Donald Pipkin?

use of dormant accounts

A useful tool for resolving the issue of what business function is the most critical, based on criteria selected by the organization, is the __________.

weighted table analysis or weighted factor analysis

The amount of effort (expressed as elapsed time) needed to make business functions work again after the technology element is recovered is known as __________.

work recovery time (WRT)

A(n) wrap-up review is a detailed examination and discussion of the events that occurred during an incident or disaster, from first detection to final recovery. __________

False

An alert digest is a description of the incident or disaster that usually contains just enough information so that each person knows what portion of the IR or DR plan to implement without slowing down the notification process. __________

False

In most organizations, the COO is responsible for creating the IR plan.

False

Training should be as specialized as possible; personnel who are responsible for one duty should not be trained on other duties to avoid confusion during a disaster.

False

Which of the following is true about a hot site?

It duplicates computing resources, peripherals, phone systems, applications, and workstations.

Explain the difference between a business impact analysis and the risk management process.

One of the differences between a BIA and the RM process is that RM focuses on identifying threats, vulnerabilities, and attacks to determine which controls can protect the info. The BIA assumes that these controls, have failed, that the attack succeeded, and that has come to fruition.

Which of the following NIST Cybersecurity Framework (CSF) stages relates to implementation of effective security controls (policy, education, training and awareness, and technology)?

Protect

Which of the following is NOT a stage in the NIST Cybersecurity Framework (CSF)?

React

When undertaking the BIA, what should the organization consider?

ScopePlan , Balance, Objective, Follow-up,

A slow-onset disaster occurs over time and gradually degrades the capacity of an organization to withstand its effects. __________

True

Disaster classification is the process of examining an adverse event or incident and determining whether it constitutes an actual disaster. __________

True

In a cold site there are only rudimentary services, with no computer hardware or peripherals.

True

Patch and proceed is an organizational CP philosophy that focuses on the defense of information assets and preventing reoccurrence rather than the attacker's identification and prosecution. __________

True

The simplest kind of validation, the desk check, involves distributing copies of the appropriate plans to all individuals who will be assigned roles during an actual incident or disaster.

True

A(n) __________ is an event with negative consequences that could threaten the organization's information assets or operations.

adverse event and incident candidate

When dealing with an incident, the incident response team must conduct a(n) __________, which entails a detailed examination of the events that occurred from first detection to final recovery.

after action review (AAR)

A(n) _________ is a description of the incident or disaster that usually contains just enough information so that each person knows what portion of the IR or DR plan to implement without slowing down the notification process.

alert message

According to NIST's SP 800-34, Rev. 1, which of the following is NOT one of the stages of the business impact assessment?

asset valuation and combine with the likelihood of attacks in a TVA worksheet.

A(n) __________ process is a task performed by an organization or one of its units in support of the organization's overall mission.

business

In the event of an incident or disaster, which planning element is used to guide off-site operations?

business continuity

When a disaster renders the current business location unusable, which plan is put into action?

business continuity

The process of examining an adverse event or incident candidate and determining whether it constitutes an actual incident is known as incident __________.

classification

The team responsible for designing and managing the IR plan by specifying the organization's preparation, reaction, and recovery from incidents is known as the __________.

computer security incident response team (CSIRT)

The actions taken by senior management to specify the organization's efforts and actions if an adverse event becomes an incident or disaster are known as __________.

contingency planning

There are six key elements that the CP team must build into the DR plan. What are three of them?

delegation responsibilities, Execution of the alert roster . Clear establishment of priorities. documentation of the disaster mitigate the impact of the disaster on the operations of the organization Alternative implementations , should primary versions be unavailable

Which of the following is a backup method that uses bulk batch transfer of data to an off-site facility and is usually conducted via leased lines or secure Internet connections?

electronic vaulting

Which of the following is the best example of a rapid-onset disaster?

flood

The total amount of time the system owner or authorizing official is willing to accept for a business process outage or disruption, including all impact considerations, is known as __________.

maximum tolerable downtime (MTD)

Contingency planning is primarily focused on developing __________.

plans for unexpected adverse events

Effective contingency planning begins with effective __________.

policy

Which of the following is an organizational CP philosophy for overall approach to contingency planning reactions?

protect and forget

Which of the following refers to the backup of data to an off-site facility in close to real time based on transactions as they occur?

remote journaling

A(n) __________ is an agency that provides physical facilities for a fee, in the case of DR/BC planning.

service bureau

The steps in IR are designed to:

stop the incident, mitigate incident effects, provide information for recovery from the incident

After an incident, but before returning to its normal duties, the CSIRT must do which of the following? .

Conduct an after-action review.

Which of the following is the first major task in the BIA, according to NIST SP 800-34, Rev. 1?

Determine mission/business processes and recovery criticality.

When an incident takes place, the disaster recovery (DR) plan is invoked before the incident response (IR) plan.

False

When performing full-interruption testing, normal operations of the business are not impacted.

False

Which of the following NIST Cybersecurity Framework (CSF) stages relates to reacting to an incident?

Respond

A(n) __________ is a document containing contact information of the individuals to notify in the event of an actual incident.

alert roster

Which of the following is the first component in the contingency planning process?

business impact analysis

The bulk batch transfer of data to an off-site facility is known as __________.

electronic vaulting

In which contingency plan testing strategy do individuals follow each and every IR/DR/BC procedure, including the disruption of service, restoration of data from backups, and notification of appropriate individuals?

full-interruption

Which of the following is a part of the incident recovery process?

identifying the vulnerabilities that allowed the incident to occur and spread

A(n) __________ occurs when an attack affects information resources and/or assets, causing actual damage or other disruptions.

incident

Which of the following is the process of examining a possible incident and determining whether it constitutes an actual incident?

incident classification

Which of the following is a mathematical tool that is useful in assessing the relative importance of business functions based on criteria selected by the organization?

weighted table analysis

At what point in the incident life cycle is the IR plan initiated

when an incident is detected that affects the organization

If operations at the primary site cannot be quickly restored, the __________ occurs concurrently with the DR plan, enabling the business to continue at an alternate site.

BCP , business continuity plan ,BC plan

The four components of contingency planning are the __________, the incident response plan, the disaster recovery plan, and the business continuity plan.

BIA , business impact analysis

__________ planning ensures that critical business functions can continue if a disaster occurs.

Business continuity (BC)

What are the major components of contingency planning?

Business impact analysis (BIA) ,Incident response plan (IR plan), Disaster recovery plan (DR plan), Business continuity plan (BC plan),

What teams are involved in contingency planning and contingency operations?

Contingency planning management team ,Incident response team, Disaster recovery team, Business continuity team,

__________ is a backup technique that stores duplicate online transaction data along with duplicate databases at the remote site on a redundant server.

Database shadowing

List four of the eight key components of a typical IR policy.

- Statement of management commitment - Scope of the policy - Performance measures - Reporting and contact forms