Itsy 2342 Incident Response And Handling Test 3

Front 1

What is the main difference between the two approaches to Incident Response?

Back 1

Cost

Front 2

The two approaches to Incident Response are: _____ and _____ as well as Apprehend and Prosecute.

Back 2

Protect and Forget

Front 3

The two approaches to Incident Response are: Protect and Forget as well as _____ and _____.

Back 3

Apprehend and Prosecute

Front 4

Detection, logging, and analysis of events are steps for which approach to Incident Response?

Back 4

Both Protect and Forget & Apprehend and Prosecute

Front 5

Recover and prevent recurrence are steps for which approach to Incident Response?

Back 5

Both Protect and Forget & Apprehend and Prosecute

Front 6

Identifying and apprehending the intruder are steps for which approach to Incident Response?

Back 6

Apprehend and prosecute

Front 7

Preserving potential evidence for prosecution are steps for which approach to Incident Response?

Back 7

Apprehend and prosecute

Front 8

The Steps: Figure out vulnerability > Patch > Move on are most closely related to which approach to Incident Response?

Back 8

Protect and forget

Front 9

The Steps: Forensics involved, chain of evidence, preservation of evidence most closely related to which approach to Incident Response?

Back 9

Apprehend and prosecute

Front 10

Disabling compromised user accounts is a _____.

Back 10

Incident Containment Strategies

Front 11

Reconfiguring a firewall to block the problem traffic is a _____.

Back 11

Incident Containment Strategies

Front 12

Temporarily disabling the compromised process or service is a _____.

Back 12

Incident Containment Strategies

Front 13

Taking down the conduit application or server is a _____.

Back 13

Incident Containment Strategies

Front 14

Stopping all computers and network devices _____.

Back 14

Incident Containment Strategies

Front 15

Containment strategies focus on two tasks: _____ the _____ and Recovering control of the affected systems.

Back 15

Stopping the incident

Front 16

Containment strategies focus on two tasks: Stopping the incident and _____ _____ of the _____ _____.

Back 16

Recovering control of the affected systems

Front 17

The four steps in the recovery phase following and incident are:_____ and _____ _____, Restore Data, Restore Services and Processes, Restore Confidence Across the Organization.

Back 17

Identify and Resolve Vulnerabilities

Front 18

The four steps in the recovery phase following and incident are: Identify and Resolve Vulnerabilities, Restore _____, Restore Services and Processes, Restore Confidence Across the Organization.

Back 18

Data

Front 19

The four steps in the recovery phase following and incident are: Identify and Resolve Vulnerabilities, Restore Data, Restore _____ and _____, Restore Confidence Across the Organization.

Back 19

Services and Processes

Front 20

The four steps in the recovery phase following and incident are: Identify and Resolve Vulnerabilities, Restore Data, Restore Services and Processes, Restore _____ _____ the _____.

Back 20

Confidence Across the Organization

Front 21

Documents the lessons learned and generates IR plan improvements is one of the things a _____ provides

Back 21

AAR (After-Action Review)

Front 22

Historical record of events, for possible legal proceedings is one of the things a _____ provides

Back 22

AAR (After-Action Review)

Front 23

Becomes a case training tool is one of the things a _____ provides

Back 23

AAR (After-Action Review)

Front 24

Provides closure to the incident is one of the things a _____ provides

Back 24

AAR (After-Action Review)

Front 25

Business resumption (BR) plan consists of a _____ _____ plan and Business continuity (BC) plan.

Back 25

Disaster recovery (DR)

Front 26

Business resumption (BR) plan consists of a Disaster recovery (DR) plan and _____ _____ plan.

Back 26

Business continuity (BC)

Front 27

Lists and describes the efforts to resume normal operations at the primary places of business.

Back 27

Disaster Recovery Plan (DRP)

Front 28

Steps for implementing critical business functions using alternate mechanisms until normal operations can be resumed at the primary site or elsewhere on a permanent basis

Back 28

Business Continuity Plan (BCP)

Front 29

Which of the five procedural mechanisms in restoration and continuation of business involves backup and storage of data?

Back 29

Delayed protection

Front 30

Which of the five procedural mechanisms in restoration and continuation of business involves RAID, Mirroring and redundancies?

Back 30

Real-time protection

Front 31

Which of the five procedural mechanisms in restoration and continuation of business involves Bare Metal?

Back 31

Server recovery

Front 32

Which of the five procedural mechanisms in restoration and continuation of business involves one failing and a secondary taking over? (Hint: Look for the word, Application)

Back 32

Application Recovery

Front 33

Which of the five procedural mechanisms in restoration and continuation of business involves Bulk data transfers, Remote journaling, and Database/Databank shadowing? (Hint: Look for the word, Site)

Back 33

Site Recovery

Front 34

A complete backup of the entire system, including all applications, operating systems components, and data.

Back 34

Full Backup

Front 35

The storage of all files that have changed or been added since the last full backup.

Back 35

Differential Backup

Front 36

A back that archives files that have been modified that day, and thus requires less space and time to create than the differential backup.

Back 36

Incremental Backup

Front 37

What is RAID is not helpful in production environments?

Back 37

RAID 0

Front 38

What RAID is used for mirroring and disk duplexing?

Back 38

RAID 1

Front 39

What RAID is most commonly used in production environments and can be hot swapped?

Back 39

RAID 5

Front 40

The bulk transfer of data in batches to an off-site facility is called _____ _____.

Back 40

electronic vaulting

Front 41

Transferring data to server archives offsite (vaults) is called _____ _____

Back 41

electronic vaulting

Front 42

Freebie: The purpose of the DRP

Back 42

True

Front 43

Fully configured computer facility

Back 43

Hot site

Front 44

Duplicates computing resources, peripherals, phone systems, applications, and workstations

Back 44

Hot site

Front 45

Can be 24/7 if desired

Back 45

Hot site

Front 46

Can be a mirrored site that is identical to the primary site

Back 46

Hot site

Front 47

Provides some of the same services and options as a hot site

Back 47

Warm site

Front 48

May include computing equipment and peripherals but not workstations

Back 48

Warm site

Front 49

Has access to data backups or off-site storage

Back 49

Warm site

Front 50

Lower cost than a hot site, but takes more time to be fully functional

Back 50

Warm site

Front 51

Provides only rudimentary services and facilities

Back 51

Cold site

Front 52

No computer hardware or software are provided

Back 52

Cold site

Front 53

Communications services must be installed when the site is occupied

Back 53

Cold site

Front 54

Often no quick recovery or data duplication functions on site

Back 54

Cold site

Front 55

Primary advantage is cost

Back 55

Cold site

Front 56

Leased site shared with other organizations

Back 56

Timeshare

Front 57

Possibility that more than one organization might need the facility simultaneously

Back 57

Timeshare

Front 58

Service agency that provides physical facilities in the event of a disaster

Back 58

Service bureaus

Front 59

May provide off-site data storage

Back 59

Service bureaus

Front 60

Contract between two organizations to provide mutual assistance in the event of a disaster

Back 60

Mutual agreement

Front 61

Each organization is obligated to provide facilities, resources, and services to the other

Back 61

Mutual agreement

Front 62

Good for divisions of the same parent company, between business partners, or when both parties have similar capabilities and capacities

Back 62

Mutual agreement

Front 63

A memorandum of agreement (MOA) should be drawn up with specific details

Back 63

Mutual agreement

Front 64

Balances safety and redundancy against costs

Back 64

RAID Level 5

Front 65

Stripes data across multiple drives

Back 65

RAID Level 5

Front 66

Parity is interleaved with data segments on all drives

Back 66

RAID Level 5

Front 67

Hot-swappable: drives can be replaced without shutting down the system

Back 67

RAID Level 5

Front 68

Uses twin drives in a system

Back 68

RAID Level 1 (disk mirroring)

Front 69

All data written to one drive is written to the other simultaneously

Back 69

RAID Level 1 (disk mirroring)

Front 70

Is expensive and is an inefficient use of disk space

Back 70

RAID Level 1 (disk mirroring)

Front 71

Vulnerable to a disk controller failure

Back 71

RAID Level 1 (disk mirroring)

Front 72

Disk duplexing: mirroring with dual disk controllers

Back 72

RAID Level 1 (disk mirroring)

Front 73

Not redundant

Back 73

RAID Level 0 (disk striping without parity)

Front 74

Spreads data across several drives in segments called stripes

Back 74

RAID Level 0 (disk striping without parity)

Front 75

Failure of one drive may make all data inaccessible

Back 75

RAID Level 0 (disk striping without parity)