Cybersecurity Fundamentals - Incident Response and Recovery-#6

What is the term for the process of restarting/restoring data that has been lost, accidentally deleted, corrupted or made inaccessible for any reason?

Data recovery

Which NIST definition means any observable occurrence in a system or network - it is any change or interruption within an IT infrastructure? 1. Event; 2. Incident; 3. Emergency; 4. Disaster; 5. Crisis

Event

Which is the following an example of: system crash; disk error; user forgetting their password? [incident or event]

Event

What is the key difference between an incident and an event?

An incident implies a violation or imminent threat and and event does not

Which phase of response occurs after an incident has been identified and confirmed and the team conducts a detailed assessment and contacts the system owner or business manager of the affected information system. 1. Detection and analysis phase; 2. Containment; 3. Eradication; 4. Recovery; 5. Post-incident activity

Incident containment

Which phase occurs after containment measures have been deployed, it is time to determine the root cause of the incident and eradicate it-eradication can happen by restoring backups to achieve a clean slate of the system, removing the root cause, improving defenses and performing vulnerability analysis to find further potential damage from the same root cause. 1. Detection and analysis phase; 2. Containment; 3. Eradication; 4. Recovery; 5. Post-incident activity

Incident eradication

Which phase of response plan ensure that affected systems or services are restored to a condition specified in the service delivery objective (SDO) or business continuity plan (BCP). 1. Detection and analysis phase; 2. Containment; 3. Eradication; 4. Recovery; 5. Post-incident activity

Incident recovery

Which type of backup copies all files that have changed since the last backup was made, regardless of whether the last backup was a full or incremental backup; this is the fastest backup method but the slowest method for restoring data? 1. Full backups; 2. Incremental backups; 3. Differential backups

Incremental backups

Which of the following categories of cybersecurity incidents applies: unconfirmed incidents that are potentially malicious or anomalous activity. 1. Unauthorized access; 2 Denial of service (DoS); 3. Malicious code; 4. Improper Usage; 5. Scans/Probes/Attempted Access; 6. Investigation

Investigation

Which phase of incident response is where capability of identifying an adversary is required? 1. Detection and analysis phase; 2. Containment; 3. Eradication; 4. Recovery; 5. Post-incident activity

Investigation or containment

Which cybersecurity incident category does the following apply to; successful installation of malicious software-e.g. virus, worm, trojan horse, or other code-based malicious entity-that infects an operating system or application? 1. Unauthorized access; 2 Denial of service (DoS); 3. Malicious code; 4. Improper Usage; 5. Scans/Probes/Attempted Access; 6. Investigation

Malicious code

True or False: A Disaster Recovery Plan (DRP) is a set of human, physical, technical and procedural resources to recover, within a defined time and cost, and activity interrupted by an emergency or disaster?

True

True or False: A DoS or Denial of Service is an example of a security incident.

True

True or False: A business continuity plan (BCP) are the action plans you will put in effect when an incident occurs so that business operations are sustained, and the organization can recover sooner than later.

True

True or False: A business impact analysis (BIA) provides the basis for: recovery time objectives; service delivery objectives; recovery point objectives.

True

True or False: A cybersecurity incident is an adverse event that negatively impacts the confidentiality, integrity, and availability of data; they may be unintentional, such as someone forgetting to activate an access list in a router, or intentional, such as a targeted attack by a hacker.

True

True or False: A cybersecurity-related disaster may occur when a disruption in service is caused by system malfunction, accidental file deletions, untested application releases, loss of backup, network DoS attacks, intrusions or viruses.

True

True or False: All interruptions are not disasters, but a small incident not addressed in a timely or proper manner may lead to a disaster.

True

True or False: An incident meant there is a bigger problem that can occur-because incidents affect confidentiality, integrity, and availability, it is important to respond quickly to any security incident.

True

True or False: An incident response may include evacuation of a facility, initiating a disaster recovery plan (DRP), performing damage assessment, and any other measures necessary to bring an enterprise to a more stable status.

True

True or False: An organization's DRP or data recovery plan must provide the strategy for how data will be recovered and assign recovery responsibilities.

True

True or False: Assigning ownership and establishing chain of custody are part of the identification in incident response plan activity.

True

True or False: At the end of the incident response process a report should always be developed to share what occurred: 1. write incident report; 2. analyze issues encountered during incident response efforts; 3. propose improvements; 4. present report to relevant stakeholders.

True

True or False: Backup procedures are used to copy files to a second medium such as a disk, tape, or the cloud. Backup files should be kept in an offsite location.

True

True or False: Disasters are disruptions that cause critical information resources to be inoperative for a period of time, adversely impacting organizational operations; the disruptions could be a few minutes to several months depending on the extent of damage to the information resource.

True

True or False: Disasters require recovery efforts to restore operational status.

True

True or False: If an individual gains logical or physical access without permission to a network, system, application, data or other resource, the correct incident category this would fall under is unauthorized access.

True

True or False: In order for a business continuity plan (BCP) to be effective, it must be aligned with the strategy of the organization.

True

True or False: In order to prepare and identify an incident, organizations use a myriad of security tools such as vulnerability assessments, firewalls, and intrusion detection system (IDS) that collect a high volume of data.

True

True or False: Incident preparation involves the following activities: 1. establish approach to handling incidents; 2. establish policy and warning banners to deter intruders and allow information collection; 3. establish communication plan with stakeholders; 4. develop incident reporting criteria; 5. develop process to activate the incident management team; 6. establish secure location to execute the incident response plan; 7. ensure equipment needed is available.

True

True or False: Incident response is the name of a formal program that prepares an entity for an incident.

True

True or False: Log data overload can be mitigated by employing security event management (SEM).

True

True or False: Obtaining and preserving evidence, documenting action, and managing public communications are action associated with incident containment.

True

True or False: Once human safety plans are in place, the additional purpose of business continuity planning (BCP/disaster recovery planning/DRP) is to enable a business to continue offering critical services in the event of a disruption, and to survive a disastrous interruption to activities.

True

True or False: Physical incidents may include: social engineering and lost or stolen laptops or mobile devices.

True

True or False: Post incident activities typically include the following: communicating findings to key stakeholders; proposing improvements; and writing an incident report.

True

True or False: Recovery time objective (RTO) is the term for the amount of time allowed for the recovery of a business function or resource after a disaster occurs-it is usually determined based on the point where the ongoing cost of the loss is equal to the cost of recovery.

True

True or False: Security Event Management (SEM) automatically aggregates and correlates security event log data across multiple security devices allowing security analysts to focus on a manageable list of critical events.

True

True or False: Senior management is responsible for the business continuity plan because they are entrusted with safeguarding the assets and the viability of the organization.

True

True or False: Some disasters are natural calamities; earthquakes; floods; tornadoes; and fire. Humans, terrorists, hacker attacks, viruses, or human error.

True

True or False: Technical incidents include: viruses, malware, denial of service, and system failure.

True

True or False: Technical information security incidents may involve: viruses, malware, or denial of service (DoS).

True

True or False: The Information System BCP should be aligned with the strategy of the organization.

True

True or False: The Information System BCP/DRP is a major component of an organizations overall business continuity and disaster recovery strategy. If the IS plan is a separate plan, it must be consistent with and support the corporate BCP.

True

True or False: The business continuity plan (BCP) is generally followed by the business and supporting units to provide a reduced but sufficient level of functionality in the business operations immediately after encountering an interruption, while recovery is taking place.

True

True or False: The business impact analysis (BIA) should consider the following: potential vulnerabilities; efficiency and effectiveness of risk countermeasures; and probability of occurrence of threats.

True

True or False: The business impact analysis provides the basis for business continuity planning which determines recovery time objectives, recovery point objectives, maximum tolerable outages, and service delivery objectives.

True

True or False: The business impact analysis should answer what the different business processes are, the critical information resources related to an organizations critical business process, and the critical recovery time period for information resources before significant or unacceptable losses are suffered.

True

True or False: The most important objective of a business continuity plan (BCP) is: ensuring safety and security of human life.

True

True or False: When it comes to disaster recovery, the number one priority is ensuring the safety and security of human life; this includes plans for drills, evacuation plans and on-site shelters.

True

True or False; SEM or Security Event Management is an emerging solution used to address the problem that security teams have in analyzing and interpreting an overwhelming amount of data to prepare for and identify and incident-it is referred to as log data overload.

True

Which cybersecurity incident category does the following fall under: individual gains logical or physical access without permission to a network, system, application, data, or other resource? 1. Unauthorized access; 2 Denial of service (DoS); 3. Malicious code; 4. Improper Usage; 5. Scans/Probes/Attempted Access; 6. Investigation

Unauthorized access

What are the 3 types of backups?

1. Full backups; 2. Incremental backups; 3. Differential backups

What 4 activities are included as part of incident response?

1. Preparation; 2. Detection; 3. Recovery; 4. Post incident Activity

What are the 5 phases of incident response?

1. Detection and analysis phase; 2. Containment; 3. Eradication; 4. Recovery; 5. Post-incident activity

What is the hierarchy of potential damage from high to low 1-5?

1. Event; 2. Incident; 3. Emergency; 4. Disaster; 5. Crisis

What are the 5 categories of cybersecurity incidents?

1. Unauthorized access; 2 Denial of service (DoS); 3. Malicious code; 4. Improper Usage; 5. Scans/Probes/Attempted Access; 6. Investigation

How would these 9 business continuity tasks be placed in order: 1. audit the plan; 2. maintain plans; 3. prepare business impact analysis (BIA); 4. choose strategy to recover critical IS facilities; 5. develop business continuity plan; 6. train staff and test plans; 7. develop disaster recovery plan; 8. store plans for ease of access despite network failure; 9. identify and prioritize required resources.

1. prepare business impact analysis (BIA); 2. identify and prioritize required resources; 3. choose strategy to recover critical IS facilities; 4. develop disaster recovery plan; 5. develop business continuity plan; 6. train staff and test plans; 7. maintain plans; 8. store plans for ease of access despite network failure; 9. audit the plans

What is the term for any major incident which has grown out of control and increased in severity?

A crisis

What event must happen to involve fallback plans?

A disaster

Which of the following category of cybersecurity incidents does the following apply to: any activity that seeks to access or identify a computer, open ports, protocols, service or any combination of the above? 1. Unauthorized access; 2 Denial of service (DoS); 3. Malicious code; 4. Improper Usage; 5. Scans/Probes/Attempted Access; 6. Investigation

Attempted access

Which hierarchical level of potential damage is more serious and implies that a major incident is spiraling out of control and growing in severity; if this particular team decides to meet, it is a very serious situation? 1. Event; 2. Incident; 3. Emergency; 4. Disaster; 5. Crisis

Crisis

What is the term for a plan used by an enterprise to respond to disruption of critical business processes; depends on the contingency plan for restoration of critical systems?

Business Continuity Plan (BCP)

What is the term for a group of people integrated at the enterprise with clear lines of reporting and responsibilities for standby support in case of an information systems emergency; this group will act as an efficient corrective control, and should also act as a single point of contact for all incidents and issues related to information systems?

Computer Emergency Response Team (CERT)

What is the term for a team established within an enterprise to respond to computer security incidents?

Computer Security Incident Response Team (CSIRT)

Which of the following category of cybersecurity incident does the following apply to: an attack that successfully prevents or impairs normal authorized functionality of networks, systems, or applications by exhausting resources? 1. Unauthorized access; 2 Denial of service (DoS); 3. Malicious code; 4. Improper Usage; 5. Scans/Probes/Attempted Access; 6. Investigation

Denial of Service (DoS)

Which phase of incident response identifies incidents as early as possible and effectively assess the nature or the incident? 1. Detection and analysis phase; 2. Containment; 3. Eradication; 4. Recovery; 5. Post-incident activity

Detection and Analysis

Which type of backup copies only the files that have changed since the last full backup; the files grow until the next full backup is performed. 1. Full backups; 2. Incremental backups; 3. Differential backups

Differential backups

Which level of hierarchy of potential damage suggests a much larger level of impact or damage; declaring this often invokes fallback plans? 1. Event; 2. Incident; 3. Emergency; 4. Disaster; 5. Crisis

Disaster

Which level in the hierarchy of potential damage generally suggests a serious local incident, requiring management attention? 1. Event; 2. Incident; 3. Emergency; 4. Disaster; 5. Crisis

Emergency

Which of the following is not included as part of incident preparation: 1. Establish approach to handling incidents; 2. Develop incident reporting criteria; 3. Establish chain of custody; 4. Establish communication plan with stakeholders?

Establish chain of custody is not included.

Which type of backup provides a complete copy of every selected file on the system, regardless of whether it was backed up recently. It is the slowest backup method but the fastest method for restoring data. 1. Full backups; 2. Incremental backups; 3. Differential backups

Full backups

Which of the following category of cybersecurity incident applies: authenticates identity of sender and receiver to ensure privacy of message contents (including attachments): 1. Unauthorized access; 2 Denial of service (DoS); 3. Malicious code; 4. Improper Usage; 5. Scans/Probes/Attempted Access; 6. Investigation

Improper Usage

Which NIST definition means a violation or imminent threat to computer security policies, acceptable use policies, or standard security practices? 1. Event; 2. Incident; 3. Emergency; 4. Disaster; 5. Crisis

Incident

Which is the following an example of: multiple failed login attempts from an unfamiliar system; denial of service; or changes to hardware or software without owner's consent: [incident or event]?

Incident

Which incident response uses procedures to contain the incident, reduce losses, and return operations to normal? 1. Detection and analysis phase; 2. Containment; 3. Eradication; 4. Recovery; 5. Post-incident activity

Mitigation or recovery

Which incident response determines corrective action to prevent similar incidents in the future? 1. Detection and analysis phase; 2. Containment; 3. Eradication; 4. Recovery; 5. Post-incident activity

Post-incident activity

What is the term for the last known point of good data in a disaster recovery plan (DRP) and is the earliest point in time to which it is acceptable to recover data?

Recovery Point Objective

Who is responsible for business continuity planning (BCP)?

Senior management

What is the term directly related to the business needs, it is the levels of services to be reached during the alternate process mode until the normal situation is restored?

Service Delivery Objective (SDO)

True or False: A Business Continuity Plan (BCP) is a strategy used by an enterprise to respond to a disruption of critical business processes?

True