Final review CP

In a CPMT, the _________ should be a high-level manager with influence and resources that can be used to support the project team, promote the objectives of the CP project, and endorse the results that come from the combined effort .

champion

Companies may want to consider budgeting for contributions to employee loss expenses (such as funerals) as well as for counseling services for employees and loved ones as part of

crisis management budgeting

An organization aggregates all local backups to a central repository and then backs up that repository to an online vendor with a _________ backup strategy.

disk-to-disk-to-cloud

From the detailed scenarios they create, the BIA planning team must estimate the cost of the best, worst, and most likely outcomes by preparing an attack scenario __________.

end case

A CP project should have a ramrod, an executive or a high-level manager with influence and resources that can be used to support the project team, promote the objectives of the CP project, and endorse the results that come from the effort. true or false

false

A blue pill is a software program or module of code that enables ongoing privileged access to a computer while actively hiding its presence from the system kernel as well as human administrators. true or false

false

A denial of service is a malware payload that provides access to a system by bypassing normal access controls. true or false

false

A disaster recovery plan (DR plan) deals with identifying, classifying, responding to, and recovering from an incident. true or false

false

A hacker is an information security professional with authorization to attempt to gain system access in an effort to identify and recommend resolutions for vulnerabilities in those systems. true or false

false

A simulation is the CP testing strategy in which copies of the appropriate plans are distributed to all individuals who will be assigned roles during an actual incident or disaster; each individual reviews the plan and validates its components true or false

false

A system stability verifier is an application that reviews monitored files to detect unauthorized creation, modification, and deletion. true or false

false

A worm is a type of malware that is attached to other executable programs. true or false

false

An active sensor is a software or hardware monitor that is placed in the flow of network traffic in order to review the traffic and report back to a management application. true or false

false

An event is an adverse event that violates the security of an organization and represents a potential risk of loss of the confidentiality, integrity, or availability of its assets and ongoing operations. true or false

false

Disk mirroring is a RAID implementation in which one logical volume is created by storing data across several available hard drives in segments.true or false

false

Establishing the scope and responsibilities of the CSIRT is one of the last tasks the IRPT performs when forming the CSIRT. true or false

false

For recovery from an incident (as opposed to a disaster), archives are used as the most common solution. true or false

false

In computer-based training, trainees attend a seminar presentation at their computers. true or false

false

In many situations, businesses can recover from a disaster by using the cloud and automation tools to automate the forensics process. true or false

false

Incident footprinting is the process of evaluating the circumstances around organizational events, determining which events are possible incidents, and determining whether a particular event constitutes an actual incident. true or false

false

Individuals with the authorization and privileges to manage information within the organization have the lowest opportunity to cause harm or damage by accident. true or false

false

Like any major project or process within an organization, the CP process will fail without the clear and formal commitment of junior executive management. true or false

false

Platform as a Service is a service model in which entire computer systems, including OS and application resources, are made available for whatever the organization wants to implement. true or false

false

Pretexting is when an attacker provides what appears to be a legitimate communication (usually e-mail), but it contains hidden or embedded code that redirects the reply to a third-party site in an effort to extract personal or confidential information. true or false

false

RAID is an acronym for Redundant Array of Incident-Recovery Drives. true or false

false

Regardless of which IR model an organization chooses, multiple employees should be in charge of incident response. true or false

false

Risk analysis is the probability that a specific vulnerability within an organization will be attacked by a threat. true or false

false

Scoring utilities are tools used to identify which computers are active on a network as well as which ports and services are active on the computers, what function or role the machines may be fulfilling, and so on. true or false

false

The emergence of cloud computing technologies and practices has had little or no effect on the world of contingency planning and operations. true or false

false

The failure of an IDPS to react to an actual attack event is called residual response. true or false

false

The final step in the development of the CSIRT involves obtaining management support and buy-in. true or false

false

The phrase "right-of-bang" refers to events and actions before the incident is contained. true or false

false

The primary budgetary expense for DR is hardware. true or false

false

To help make the detection of actual incidents more reliable, there are three broad categories of incident indicators that have been identified: possible, unlikely, and definite. true or false

false

Tweaking is the process of adjusting an IDPS to maximize its efficiency in detecting true positives while minimizing both false positives and false negatives. true or false

false

An understanding of the potential consequences of a successful attack on an information asset by a threat is known in the risk analysis process as __________.

impact

The _________ is the total amount of time the system owner or authorizing official is willing to accept for a business process outage or disruption.

maximum tolerable downtime

While a security operations center is designed to __________, a CSIRT focuses on __________.

monitor all security operations; responding to incidents

Which of the following terms refers to an information security professional with authorization to attempt to gain system access in an effort to identify and recommend resolutions for vulnerabilities in those systems?

penetration tester

Which of the following is not a "probable indicator" of an incident?

presence or execution of unknown programs or processes

The entire program of planning for and managing risk to information assets in the organization is referred to as __________.

risk management

A(n) _________ is often included in legal documents to ensure that a vendor is not liable for actions taken by a client.

statement of indemnification

A daily backup backs up only files that were modified on that day—a date-specific incremental backup. true or false

true

A rainbow table is a list of hash values and their corresponding plaintext values that can be used to look up password values if an attacker is able to steal a system's encrypted password file. true or false

true

An intrusion detection and prevention system is like a network burglar alarm. true or false

true

Apprehend and prosecute is an organizational CP philosophy for incident response and digital forensics that focuses on the collection and preservation of potential evidence when responding to and recovering from an incident, with the expectation of possibly finding and prosecuting the attacker. true or false

true

Effective contingency planning begins with effective policy. true or false

true

Event correlation involves examining logs from multiple systems and identifying trends or indicators of attacks across those multiple systems. true or false

true

In contingency planning, an adverse event that actually threatens the security of the organization's information assets is called an incident. true or false

true

Integrity is an attribute of information that describes how data is protected from disclosure or exposure to unauthorized individuals or systems. true or false

true

Intellectual property (IP) includes trade secrets, copyrights, trademarks, and patents. true or false

true

It is the responsibility of InfoSec personnel to deter and, where possible, prevent unethical and illegal acts. true or false

true

Noise is the ongoing activity from alarm events that are accurate and noteworthy but not necessarily as significant as potentially successful attacks. true or false

true

Policies are living documents that must be nurtured, given that they are constantly changing and growing. true or false

true

Some experts argue that the two components of business resumption planning—disaster recovery planning and business continuity planning (BCP)—are so closely linked that they are indistinguishable true or false

true

The C.I.A. triad is the industry standard for computer security since the development of the mainframe and is based on three characteristics that describe the utility of information. true or false

true

The combination of the IP address and the port is usually called a socket. true or false

true

The first stage of a tape-based backup and recovery process is the scheduling of the backups, coupled with arranging the storage of the media. true or false

true

The transference risk treatment strategy attempts to shift risk to other assets, other processes, or other organizations. true or false

true

When the IR process cannot contain and resolve an incident, the company turns to the disaster recovery and business continuity plans to help restore normal operations quickly. true or false

true

While the SOC is designed to monitor all security operations, the CSIRT focuses on responding to incidents. true or false

true

The process of adjusting a technical control to maximize its efficiency in detecting true positives while minimizing false positives and false negatives is called _________.

tuning

Electronic vaulting

Bulk transfer of data in batches to an off-site facility

One of the primary responsibilities of the IRP team is to ensure that the _________ is prepared to respond to each incident it may face.

CSIRT

After-action review

Can serve as a training case for future staff

Bare metal recovery

Allows you to reboot a system from a CD-ROM device

Indicator

An activity that may signal an adverse event is underway

Precursor

An activity that may signal an incident could occur in the future

Incident candidate

An adverse event that is a possible incident

False positive

An alert or alarm that occurs in the absence of an actual attack

Attack scenario end case

An estimate of the likelihood and impact of the best, worst, and most likely outcomes of an attack

Noise

An event that does not rise to the level of an incident

Software as a Service (SaaS)

Applications that are made available to users over the Internet

IR policy

Defines roles and responsibilities for information security

Platform as a Service (PaaS)

Development platforms that are made available to developers over the Internet

A _________ attack seeks to deny legitimate users access to services by either tying up a server's available resources or causing it to shut down.

DoS

'protect and forget'

Focuses is on the defense of the data and the systems that house, use, and transmit it

_________ incident responses enables the organization to react to a detected incident quickly and effectively, without confusion or wasted time and effort.

Predefining

_________ uses a number of hard drives to store information across multiple drive units.

RAID

CSIRT measures used to compare current versus past performance might include all of the following EXCEPT:

Text of comments from users

Simulation

The organization conducts a role-playing exercise as if an actual incident or disaster had occurred

Footprinting

The organized research and investigation of Internet addresses owned or controlled by a target organization

Incident classification

The process of evaluating the circumstances of a reported event

Fingerprinting

The process of gathering information about the organization and its network activities

A key step in the _________ approach to incident response is to discover the identity of the intruder while documenting their activity.

apprehend and prosecute

The final component to the CPMT planning process is to deal with _________.

budgeting for contingency operations

Storage as a service

A cloud computing capability for data backup and archiving

Data as a service

A cloud computing capability for data sets and databases

Trigger

A review of an unusual pattern of entries in a system log

Cyber kill

A series of steps that document the stages of a cyberattack

Formal class

A single trainer works with multiple trainees in a formal setting

Organization charts

A source of information for developing IR policy

The __________ resides on a particular computer or server, known as the host, and monitors activity only on that system.

HIDPS

Public cloud

Implementation in which a service provider makes computing resources available over the Internet

community cloud

Implementation in which several organizations share computing resources

Disk mirroring

Implementation of RAID level 1

Full-interruption testing

Too risky for most businesses

Distance learning

Trainees receive a seminar presentation at their computers

Storage area network

Uses fiber-channel direct connections between systems and storage devices

IR plan

Usually activated when an incident is first detected