437 Final Exam

Front 1

A continuously changing process presents challenges in acquisition, as there is not a fixed state that can be collected, hashed and so forth. This has given rise to the concept of ____ forensics which captures a point-in-time picture of a process

Back 1

Snapshot Forensics

Front 2

____ is used both for intrusion analysis and as part of evidence collection and analysis

Back 2

Forensics

Front 3

In evidence handling, specifically designed ___ are helpful because they are very difficult to remove without breaking

Back 3

Evidence Seals

Front 4

A search is constitutional if it does not violate a person's reasonable or legitimate ____.

Back 4

Expectation of Privacy

Front 5

The forensic tool ____ does extensive pre-processing of evidence items that recovers deleted files and extracts e-mail messages

Back 5

Forensic ToolKit

Front 6

Most digital forensics teams have a pre-packed field kit, also known as a(n) ____ .

Back 6

Jump bag

Front 7

The ____ handles computer crimes that are categorized as felonies.

Back 7

FBI

Front 8

Forensic investigators use ___ copying when making a forensic image of a device, which reads a sector from the source drive and writes it to the target drive; this process continues until all sectors on the suspect drive have been copied.

Back 8

Bitstream Copying

Front 9

Grounds for challenging the results of a digital investigation can come from possible ____ - that is, alleging that the relevant evidence came from somewhere else or was somehow tainted in the collection process.

Back 9

Contamination

Front 10

The U.S. Department of Homeland Security's federal emergency management association has developed a support web site at ____ that includes a suite of tools to guide the development of disaster recovery/business continuity plans.

Back 10

www.ready.gov

Front 11

Two dominantly recognized professional institutions certifying business continuity professionals agree on the ___ as the basis for certification

Back 11

Common body of knowledge

Front 12

Unless an organization has contracted for a ___ equivalent, office equipment such as desktop computers are not provided at BC alternate site

Back 12

Hot Site

Front 13

____ planning represents the final response of the organization when faced with any interruption of its critical operations.

Back 13

Business Continuity

Front 14

A BC subteam called the ___ is responsible for establishing the core business functions needed to sustain critical business operations

Back 14

Operations team

Front 15

One activity that occurs during the clearing phase of a BC implementation is scheduling a move back to the primary site.

Back 15

False

Front 16

In the ___ phase of the BC plan, the organization specifies what type of relocation services are desired and what type of data management strategies are deployed to support relocation

Back 16

Preparation for BC actions

Front 17

____ occur over time and slowly deteriorate the organization's capacity to withstand their effects.

Back 17

slow onset disasters

Front 18

Contingency strategies for ___ should emphasize the need for absolutely reliable data backup and recovery procedures because they have less inherent redundancy than a distributed architecture.

Back 18

Mainframes

Front 19

____ may be caused by earthquakes, floods, storm winds, tornadoes or mud flows.

Back 19

Rapid onset disasters

Front 20

____ disasters include acts of terrorism and acts of war

Back 20

Man-made

Front 21

Once the incident has been contained, and all signs of the incident removed the ___ phase begins.

Back 21

actions after

Front 22

A ___ is a description of the disasters that may befall an organization, along with information on their probability of occurrence, a brief description of the organization's actions to prepare for that disaster, and the best case, worst case, and most likely case outcomes of the disaster

Back 22

Disaster scenario

Front 23

____ are high probable when infected machines are brought back online or when other infected computers that may have been offline at the time of the attack are brought back up.

Back 23

follow-on incidents

Front 24

____ is the set of actions taken by an organization in response to an emergency situation in an effort to minimize injury or loss of life.

Back 24

crisis management

Front 25

In contrast to emergency response that focuses on the immediate safety of those affected, ____ addresses the services needed to get the organization and its stakeholders back to original levels of productivity or satisfaction.

Back 25

Humanitarian assistance

Front 26

____ is the movement of employees from one position to another so they can develop additional skills and abilities

Back 26

Task rotation

Front 27

A(n) ___ is the list of officials ranging from an individual's immediate supervisor through the top executive of the organization

Back 27

chain of command

Front 28

A(n) ____ is created to enable management to gain and maintain control of ongoing emergency situations, to provide oversight and control to designated first responders, and to marshall IR, DR and DC plans and resources as needed.

Back 28

Crisis management team

Front 29

Organizations typically respond to a crisis by focusing on technical issues and economic priorities, and overlook the steps needed to preserve the most critical assets of the organization; its people.

Back 29

True

Front 30

____ are those actions taken in order to manage the immediate physical, health and environmental impacts resulting form an incident.

Back 30

Emergency response

Front 31

____ refers to those actions taken to meet the psychological an emotional needs of various stakeholders.

Back 31

Humanitarian assistance

Front 32

According to the 2010/2011 computer crime and security survey, ___ is "the most commonly seen attack , with 67.1 percent of respondents reporting it."

Back 32

malware infection

Front 33

When an alert warns of new malicious code that targets software used by an organization, the first response should be to research the new virus to determine whether it is ____.

Back 33

real

Front 34

In a block containment strategy, in which the attacker's path into the environment is disrupted, you should use the most precise strategy possible, starting with ____.

Back 34

Blocking a specific IP address

Front 35

If a user receives a message whose tone and terminology seems intended to invoke a panic or sense of urgency, it may be a(n) ____.

Back 35

Hoax

Front 36

Many malware attacks are ___ attacks, which involve more than one type of malware and/or more than one type of transmission method

Back 36

Blended

Front 37

A ____ is a small quantity of data kept by a website as a means of recording that a system has visited that web site

Back 37

Cookie

Front 38

A(n) ___ attack is a method of combining attacks with rootkits and back doors.

Back 38

Hybrid

Front 39

According to NIST, which of the following is an example of a UA attack?

Back 39

Modifying web-based content without permission

Front 40

Which of the following is the most suitable as a response strategy for malware outbreaks?

Back 40

blocking known attackers

Front 41

The ___ team is responsible for working with suppliers and vendors to replace damaged or destroyed equipment or services, as determined by the other teams.

Back 41

Vendor Contact

Front 42

The ___ team is responsible for the recovery of information and the reestablishment of operations in storage area networks or network attached storage.

Back 42

storage recovery team

Front 43

The ___ system is an information system with telephony interface that can be used to automate the alert process.

Back 43

auxiliary phone alert and reporting system

Front 44

___ is the inclusion of action steps to minimize the damage associated with the disaster on the operations of the organization.

Back 44

Mitigation impact

Front 45

The ____ team is primarily responsible for data restoration and recovery.

Back 45

Data management

Front 46

The ___ is the phase associated with implementing the initial reaction to a disaster; it is focused on controlling or stabilizing the situation, if that is possible.

Back 46

response phase

Front 47

The ___ team is responsible for recovering and reestablishing operating systems (OSs).

Back 47

systems recovery team

Front 48

During the ____ phase, the organization begins the recovery of the most time-critical business functions- those necessary to reestablish business operations and prevent further economic and image loss to the organization

Back 48

recovery

Front 49

____ is a set of focused steps that deal primarily with the safety and state of the people from the organization who are involved in the disaster.

Back 49

Crisis management

Front 50

Essential BC supplies needed at an alternate site include portable computers, software media and ____.

Back 50

licenses

Front 51

Most disaster related loss occurs because of physical damage to property.

Back 51

False

Front 52

____are those steps taken to inform stakeholders regarding the timeline of events, the actions taken, and sometimes the reasons for those actions.

Back 52

crisis communications