Incident Response and Management Final
Exam Questions
Course Introduction
Incident Response and Management is a comprehensive course that equips students with the fundamental concepts, strategies, and best practices necessary for effectively preparing for, detecting, responding to, and recovering from cybersecurity incidents. The course covers the lifecycle of an incident response process, including identification, containment, eradication, and post-incident analysis. Emphasis is placed on building and managing incident response teams, developing incident response plans, adhering to legal and regulatory requirements, and applying various tools and methodologies to real-world scenarios. Students will gain practical experience through case studies and simulations, preparing them to manage security incidents in organizational environments.
Recommended Textbook
of Incident Response and Disaster
Available Study Resources on Quizplus 11 Chapters
549 Verified Questions
549 Flashcards
Source URL: https://quizplus.com/study-set/2243 Page 2
Principles
Recovery 1st Edition by Michael E. Whitman
Chapter 1: Contingency Planning Within Information Security
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/44623
Sample Questions
Q1) What are the steps in contingency planning?
Answer: 1.The IR plan focuses on immediate response,but if the attack escalates or is disastrous (such as a fire,flood,earthquake,or total blackout)the process moves on to disaster recovery and business continuity.
2.The DR plan typically focuses on restoring systems at the original site after disasters occur,and as such is closely associated with the BC plan.
3.The BC plan runs concurrently with DRP when the damage is major or long term,requiring more than simple restoration of information and information resources.The BC plan establishes critical business functions at an alternate site.
Q2) For the purpose of relative risk assessment,____________________ <i>equals</i> likelihood of vulnerability occurrence <i>times </i>value (or impact)<i>minus</i> percentage risk already controlled <i>plus</i> an element of uncertainty.
Answer: risk
To view all questions and flashcards with answers, click on the resource link above. Page 3
Chapter 2: Planning for Organizational Readiness
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/44624
Sample Questions
Q1) ____ collect and provide reports on failed login attempts,probes,scans,denial-of-service attacks,and viruses detected,to name a few.
A)Departmental reports
B)Financial reports
C)Scheduled reports
D)System logs
Answer: D
Q2) A(n)____ is generally thought of as a group of individuals united by shared interests or values within an organization and who share a common goal of making the organization function to meet its objectives.
A)database community
B)network community
C)community of interest
D)incident response community
Answer: C
Q3) Effective contingency planning begins with effective policy.
A)True
B)False
Answer: True
To view all questions and flashcards with answers, click on the resource link above.
Page 4
Chapter 3: Incidence Response: Preparation, Organization, and Prevention
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/44625
Sample Questions
Q1) What are some of the circumstances that could cause the IR team to be activated and the IR plan to be initiated?
Answer: A phone call from a user to the help desk about unusual computer or network behavior
Notification from a systems administrator about unusual server or network behavior
Notification from an intrusion detection device
Review of system log files indicating an unusual pattern of entries
Loss of system connectivity
Device malfunctions
Other specific identifiable situations that result in the invocation of the IR plan
Q2) List six strategies that can be used to test contingency plans.
Answer: Six strategies that can be used to test contingency plans are:
Desk check
Structured walk-through
Simulation
Parallel testing
Full interruption
War gaming
To view all questions and flashcards with answers, click on the resource link above. Page 5
Chapter 4: Incident Response: Detection and Decision Making
Available Study Resources on Quizplus for this Chatper
49 Verified Questions
49 Flashcards
Source URL: https://quizplus.com/quiz/44626
Sample Questions
Q1) Using a process known as ____,Network IDSs must look for attack patterns by comparing measured activity to known signatures in their knowledge base to determine whether or not an attack has occurred or may be underway.
A)clipping
B)cache poisoning
C)scanning
D)signature matching
Q2) The term ____ refers to an event that triggers alarms and causes an IDS to react as if a real attack is in progress.
A)True Attack Stimulus
B)false positive
C)Confidence Value
D)Alarm Compaction
Q3) What are the steps involved in monitoring networks for signs of intrusion?
Q4) The term ____________________ refers to a consolidation of almost identical alarms into a single higher-level alarm.
Q5) The Electronic Communications Protection Act prohibits the recording of wire- or cable-based communications unless an exception applies.Briefly discuss four of these exceptions.
To view all questions and flashcards with answers, click on the resource link above. Page 6
Chapter 5: Incidence Response: Reaction, Recovery, and Maintenance
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/44627
Sample Questions
Q1) An effective ____ plan guides an organization's response when an incident occurs,enables the prompt recovery of normal operations,and assists in the smooth transition to disaster recovery or business continuity plans when needed.
A)sequential roster
B)hierarchical
C)Incident Response
D)war game
Q2) In formulating an incident response strategy,what are some of the factors that influence the organization's decision process?
Q3) Once an actual incident has been confirmed and properly classified,the IR team moves from the detection phase to the ____________________ phase.
Q4) The ____ investigates crimes involving U.S.currency,counterfeiting,and certain cases involving credit card fraud and identity theft.
A)FBI
B)U.S.Secret Service
C)U.S.Treasury Department
D)CIA
Q5) What are the key steps in the Protect and Forget reaction strategy?
To view all questions and flashcards with answers, click on the resource link above. Page 7
Chapter 6: Contingency Strategies for Business
Resumption Planning
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/44628
Sample Questions
Q1) ____ creates one larger logical volume across several available hard disk drives and stores the data in segments,called stripes,across all the disk drives in the array.
A)RAID 0
B)RAID level 1
C)RAID level 2
D)RAID levels 3 and 4
Q2) RAID level ____ can be achieved with software or hardware,writing data to other drives,even if they are located on other systems.
A)1
B)2
C)3
D)4
Q3) ____ is most commonly used in organizations that balance safety and redundancy against the costs of acquiring and operating the systems.
A)RAID level 4
B)RAID level 5
C)RAID level 6
D)RAID level 7
To view all questions and flashcards with answers, click on the resource link above. Page 8
Chapter 7: Disaster Recovery: Preparation and Implementation
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/44629
Sample Questions
Q1) ____ considerations for desktop and portable systems should emphasize data availability,confidentiality,and integrity.
A)Forensic
B)Contingency
C)Hashing
D)Black bag
Q2) ____ may be caused by earthquakes,floods,storm winds,tornadoes,or mud flows.
A)Slow onset disasters
B)Communication disasters
C)Rapid onset disasters
D)Data disasters
Q3) When selecting an off-site storage location for data backups or stored equipment,extra care should be taken to increase the risk at that storage location.
A)True
B)False
Q4) Natural disasters such as earthquakes can usually be mitigated with multipurpose casualty insurance.
A)True
B)False
To view all questions and flashcards with answers, click on the resource link above. Page 9
Chapter 8: Disaster Recovery: Operation and Maintenance
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/44630
Sample Questions
Q1) ____ requires effective backup strategies and flexible hardware configurations.
A)War gaming
B)DR plan simulation
C)Data recovery
D)System response
Q2) What is the difference between a DR plan structured walk-through and a DR plan simulation?
Q3) The ____ team is responsible for providing any needed supplies,space,materials,food,services,or facilities needed at the primary site other than vendor-acquired technology and other material obtained by the vendor team.
A)damage assessment
B)data management
C)logistics
D)business interface
Q4) What are the primary goals associated with the restoration phase?
Q5) The ____________________ phase involves activating the disaster recovery plan and following the steps outlined therein.
Q6) What are the primary goals associated with the recovery phase?
Q7) What are some of the key points that the CP team must build into the DR plan?
To view all questions and flashcards with answers, click on the resource link above. Page 10
Chapter 9: Business Continuity Preparation and Implementation
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/44631
Sample Questions
Q1) In the ____ phase of the BC plan,the organization specifies what type of relocation services are desired and what type of data management strategies are deployed to support relocation.
A)preparation for BC actions
B)training requirements
C)roles and responsibilities
D)special considerations
Q2) A ____ is a service agency that provides a service for a fee.
A)time-share
B)service bureau
C)mobile site
D)mirrored site
Q3) Briefly describe the following two operations that must be specified in the BC plan to support return to the primary site: scheduling of employee move and vanguard clearing responsibilities.
Q4) A(n)____________________ stipulates that each organization is obligated to provide the necessary facilities,resources,and services until the receiving organization is able to recover from the disaster.
Q5) Discuss five tips for effective BC planning.
To view all questions and flashcards with answers, click on the resource link above. Page 11
Chapter 10: Business Continuity Operations and Maintenance
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/44632
Sample Questions
Q1) Good ____ can safeguard losses that occur while operating in the suboptimum conditions of the contingency deployment when errors or faults could cause additional disruptions and also because the organization needs to relocate to the primary site.
A)databases
B)technology
C)backup practices
D)forensic studies
Q2) With respect to the continuity planning process,define prioritization and discuss its importance.
Q3) Critical part of both disaster recovery and business continuity.
A)Trigger point
B)Preparation undertaken by an organization
C)Network recovery team
D)Security
E)Insurance
F)BC plan
G)BC review
H)Information systems security control
I)Plan
To view all questions and flashcards with answers, click on the resource link above. Page 12
Chapter 11: Crisis Management and Human Factors
Available Study Resources on Quizplus for this Chatper
50 Verified Questions
50 Flashcards
Source URL: https://quizplus.com/quiz/44633
Sample Questions
Q1) Are the responsibility of the first-line supervisor,who reports this information to his or her manager,who then aggregates the totals for reporting up the corporate chain of command.
A)Crisis management team
B)Head-counts
C)Critical success factors
D)The plan
E)First-level priority objectives
F)Alert roster tests
G)Tabletop exercise
H)PTSD
I)EAPs
Q2) Discuss five skills that are important to a leader during crisis management.
Q3) ____ consists of efforts designed to address the psychological and emotional impact on the workforce.
A)Crisis communications
B)Humanitarian assistance
C)Emergency response
D)Cross-training
Q4) What is the difference between management and leadership?
To view all questions and flashcards with answers, click on the resource link above. Page 13