Cjcsm 6510.01A

Front 1

Wha is CJCSM 6510.01A

Back 1

CHAIRMAN OF THE JOINT
CHIEFS OF STAFF
MANUAL

Front 2

What is CNDSPs

Back 2

CND Service Providers

Front 3

What are the three CND services CNDSPS provide

Back 3

(1) Protect, (2) Monitor, Analyze, and Detect, and (3)
Respond.

Front 4

Why was the Incident Handling Program implemented

Back 4

To provide specific guidance for C/S/As and field
activities regarding the requirements for incident handling and reporting.

Front 5

What is the responsibility of the network defenders
A)Security of Computing,Communication,Integrity
B)Communication Systems,Authentication,Integrity
C)Security of Computing,Confidentiality,Integrity

Back 5

Security of Computing,Communication systems, Integrity

Front 6

What is GIG

Back 6

Global Information Grid

Front 7

What is C/S/A

Back 7

Combatant Command/Service/Agency

Front 8

What is CND
A)Command Network Defence
B)Computer Network Diagrahm
C)Computer Network Defense

Back 8

Computer Network Defense

Front 9

What are some roles of Joint Staff, combatant commands, Services, Defense agencies, DOD field
activities, and joint

Back 9

Ensure CNDSPs are established or appointed to provide CND
Services for C/S/A or field activity information systems.

Coordinate with USSTRATCOM (JTF-GNO) on incidents prior to
coordinating or taking action outside of the Department of Defense.

Front 10

Does Joint Staff, combatant commands, Services, Defense agencies, DOD field agenciesComply with directives (including but not limited to operation orders
and communication tasking orders (CTOs).

Back 10

Yes

Front 11

Wha is CJCSM 6510.01A

Back 11

CHAIRMAN OF THE JOINT
CHIEFS OF STAFF
MANUAL

Front 12

What is CNDSPs

Back 12

CND Service Providers

Front 13

What are the three CND services CNDSPS provide

Back 13

(1) Protect, (2) Monitor, Analyze, and Detect, and (3)
Respond.

Front 14

Why was the Incident Handling Program implemented

Back 14

To provide specific guidance for C/S/As and field
activities regarding the requirements for incident handling and reporting.

Front 15

What is the responsibility of the network defenders

Back 15

To ensure the
security of computing and communication systems for executing successful
military operations and to maintain the integrity of information within the
cyber domain and throughout the Department of Defense.

Front 16

What is GIG

Back 16

Global Information Grid

Front 17

What is C/S/A

Back 17

Combatant Command/Service/Agency

Front 18

What is CND

Back 18

Computer Network Defense

Front 19

What are some roles of Joint Staff, combatant commands, Services, Defense agencies, DOD field
activities, and joint

Back 19

Ensure CNDSPs are established or appointed to provide CND
Services for C/S/A or field activity information systems.

Coordinate with USSTRATCOM (JTF-GNO) on incidents prior to
coordinating or taking action outside of the Department of Defense.

Front 20

Does Joint Staff, combatant commands, Services, Defense agencies, DOD field agenciesComply with directives (including but not limited to operation orders
and communication tasking orders (CTOs).

Back 20

Yes

Front 21

Wha is CJCSM 6510.01A

Back 21

CHAIRMAN OF THE JOINT
CHIEFS OF STAFF
MANUAL

Front 22

What is CNDSPs

Back 22

CND Service Providers

Front 23

What are the three CND services CNDSPS provide

Back 23

(1) Protect, (2) Monitor, Analyze, and Detect, and (3)
Respond.

Front 24

Why was the Incident Handling Program implemented

Back 24

To provide specific guidance for C/S/As and field
activities regarding the requirements for incident handling and reporting.

Front 25

What is the responsibility of the network defenders

Back 25

To ensure the
security of computing and communication systems for executing successful
military operations and to maintain the integrity of information within the
cyber domain and throughout the Department of Defense.

Front 26

What is GIG

Back 26

Global Information Grid

Front 27

What is C/S/A

Back 27

Combatant Command/Service/Agency

Front 28

What is CND

Back 28

Computer Network Defense

Front 29

What are some roles of Joint Staff, combatant commands, Services, Defense agencies, DOD field
activities, and joint

Back 29

Ensure CNDSPs are established or appointed to provide CND
Services for C/S/A or field activity information systems.

Coordinate with USSTRATCOM (JTF-GNO) on incidents prior to
coordinating or taking action outside of the Department of Defense.

Front 30

Does Joint Staff, combatant commands, Services, Defense agencies, DOD field agenciesComply with directives (including but not limited to operation orders
and communication tasking orders (CTOs).

Back 30

Yes

Front 31

True or False
USSTRATCOM Coordinate with the IC Incident Response Center (IC-IRC), which
operates under the authority of the IC chief information officer (CIO), on
matters relating to the governance, secure operations, and defense of the IC
networks.

Back 31

True

Front 32

What are some roles of USSTRATCOM

Back 32

Issue incident or reportable event response orders and alerts
through JTF-GNO to the C/S/As and field activities.
Coordinate with USNORTHCOM for incidents that involve the DHS
and other federal agencies where Defense Support of Civil Authorities is
involved.

Front 33

True or False
USSTRACTCOM Maintain and disseminate DOD intrusion detection system (IDS)
signature sets for DOD level sensors (Tier 1) and provide necessary threat
information to assist Tier 2 and Tier 3 CNDSP organizations developing IDS
signature sets for their sensors.

Back 33

TRUE

Front 34

How does USSTRATCOM provide reports to Secretary of Defense

Back 34

Through
Joint Staff and C/S/As and field activities, as necessary.

Front 35

Who Coordinate with the Department of Homeland Security (DHS) and
other federal agencies for incidents related to cyberspace involving the
Department of Defense

Back 35

USSTRATCOM

Front 36

Does USSTRATCOM notify and/or coordinate with the
United States Computer Emergency Readiness Team (US-CERT) on cyberspace
incidents

Back 36

Yes only when it is approriate

Front 37

True or False
The DOD Incident Handling Program is a
component of the overall CND strategy for the Department of the Navy

Back 37

False. It is a program for the DOD

Front 38

Who much Incident handling be coordinates with

Back 38

DOD organizations and sources outside the Department of Defense, such as
LE/CI, IC, and defense industrial base (DIB) partners

Front 39

What are the are the actions taken, within the Department of Defense, to
protect, monitor, analyze, detect, and respond to unauthorized activity within
DOD information systems (ISs) and computer networks
A) CND(COMPUTER NETWORK DEFENSE)
B)IA
C)CJSCM

Back 39

Computer Network defense

Front 40

What are the three tiers the DOD is organized to conduct CND

Back 40

Tier One (Global).
Tier Two (Regional/Theater).
Tier Three (Local).

Front 41

What does Tier One provides
A) DOD-wide CND operational
direction or support to C/S/As and field activities
B) Updated reports to C/SAs
C)Fix customer issues

Back 41

This tier provides DOD-wide CND operational
direction or support to C/S/As and field activities

Front 42

Who does Tier one include

Back 42

Tier One entities include
USSTRATCOM and supporting entities such as the JTF-GNO, Defense Criminal
Investigative Organization (DCIO), JTF-GNO Law Enforcement and
Counterintelligence Center (JTF-GNO LECIC), and the National Security
Agency/Central Security Service Threat Operations Center (NTOC).

Front 43

What does Tier Two (Regional/Theater).

Back 43

Tier Two provides DOD
component-wide operational direction or support and responds to direction
from Tier One

Front 44

Who does Tier Two includes

Back 44

Tier Two includes C/S/A and field activity CNDSPs designated
by heads of components to coordinate component-wide CND

Front 45

What does Tier Three provides local operational direction
or support and responds to direction from a designated Tier Two entity

Back 45

Three includes bases, posts, camps, stations, and all entities responding to
direction from a C/S/A or field activity Tier Two CNDSP (e.g., manage and
control ISs, networks and services, either deployed or fixed at DOD
Installations).

Front 46

What are the three primary CND Services
A)Protect; Monitor, Analyze and Detect; and Respond.
B)Control Protect,Investigate and Respond
C) Command Monitor Analyze Detect and Respond

Back 46

Protect; Monitor, Analyze and Detect; and Respond.

Front 47

What happens during the PROTECT phase in CND services
A)Vulnerability Analysis and Assessment support
B)CND Red Teaming
C)Malware Protection Support
D)INFOCON, IAVM

Back 47

ALL OF THEM

Front 48

WHAT IS IAVM
A)Information Assurance Vulnerability Message
B)Information Assurance Vulnerability Maker
C)Information Assurance Vulnerability Management

Back 48

Information Assurance Vulnerability Management

Front 49

What is INFOCON

Back 49

Information Operations Condition Implementation

Front 50

What happens in the MAD (mission, analyze,detect) stage of CND
A)Network Security Monitoring intrusion Detection
B)Attack Sensing and Warning (ASW
C)Indications and Warning Situation al Awareness (I&W).
D)All of the Above

Back 50

D) All of the above

Front 51

What is the Respond Stage of CND

Back 51

Incident Reporting
Incident Response
Incident Analysis

Front 52

What is a fourth area in CND

Back 52

Capability Sustainment

Front 53

Name some area Capability Sustainment cover

Back 53

MOUs and Contracts
CND Polices/Procedures
personnel levels and training
Security Administration

Front 54

True or False
CND protection services include the management of DOD’s Information Operations Condition (INFOCON) system and actions taken to create or enhance an IS, computer network configuration, or assurance posture in response to a CND alert or threat.

Back 54

True

Front 55

CND Protect services are
A)Inactive
B)Proactive
C)Reactive

Back 55

proactive

Front 56

What does CND Monitor, Analyze, and Detect Services provide. Say al that apply
A)CND situational awareness
B)attack sensing and warning
C)indications and warning

Back 56

CND situational awareness, attack sensing and warning, and indications and warning.

Front 57

What data gives Department of Defense the ability to sense changes in DOD global information and computer networks

Back 57

Attack Sensing and Warning (AS&W)

Front 58

What are some characteristics of ASW Attack Sensing and Warning (AS&W)
A)detection, correlation, identification ,characterization
B)detection,attack,evade,react
C)detect,identify,react,attack,

Back 58

A)detection, correlation, identification , and characterization

Hint 58

The detection, correlation, identification , and characterization of a large spectrum of intentional unauthorized activity, including computer intrusion or attack

Front 59

What does Indications and Warning (I&W) data gives the DOD
A)The ability to sense changes in adversary activities
B)The ability to sense attacks before it happen
C)The ability to warn

Back 59

The ability to sense changes in adversary activities

Front 60

True or FalseI&W includes those intelligence activities intended to detect and report time-sensitive intelligence information on foreign developments that could involve a threat to the United States or allied military, political, or economic interests or to U.S. citizens abroad.

Back 60

True

Front 61

True or False
The intelligence community provides indications and warning for only national states and transnational groups.

Back 61

False
The intelligence community provides indications and warning for foreign threats from national states and transnational groups.

Front 62

True or False It is the expectation that C/S/As and field activities will implement and institutionalize the guidance, procedures, and policies described in this methodology in a way that yields the intended results (as described throughout) and sustains the global, regional, and local capabilities necessary to maintain and operate a robust and effective incident handling program.

Back 62

True

Front 63

What are the basic process for DOD incident handling and lyfe cycle can be grouped into the following processes or phases

Back 63

Detection of events(2) Preliminary analysis and identification of incidents.
Preliminary response actions.
Incident analysis
Response and recovery.
Post-incident analysis

Front 64

Where is the incident report submitted to

Back 64

Joint CERT Database (JCD)

Front 65

The incident handling lifecycle shares similar characteristics with a business and military strategy known as what

Back 65

The Observe, Orient, Decide, and Act (OODA) Loop.

Front 66

What is done in the observe stage of the OODA loop for DOD
networks and systems.Name all that apply.
a)Monitor
b)Detect
c)Assest
d)Analyze

Back 66

Monitor and detect anomalous or suspicious activity within DOD networks and systems.

Front 67

Explain Orient in the OODA loop

Back 67

Collect, validate, and analyze information available about an incident to characterize the perceived threat and identify, with confidence, the nature, scope, root cause(s), and potential impact of an incident.

Front 68

Based on available information during the Decide phase in in the OODA loop we can
A) identify the necessary courses of action required to contain the incident, eradicate the risk, and recover from the incident.
B) Decide the necessary courses of action required to elimanate the problem and prevent future problems
C) identify the necessary courses of action required to contain the incident, disperse security, and recover from the incident.

Back 68

A) identify the necessary courses of action required to contain the incident, eradicate the risk, and recover from the incident.

Front 69

Explain Act in the OODA loop
A)Execute the courses of action required to resolve and close the incident and subsequently perform a postmortem
B) Execute orders given to ACT on intrusion
c)Act out orders given with military combat

Back 69

Execute the courses of action required to resolve and close the incident and subsequently perform a postmortem

Hint 69

Execute the courses of action required to resolve and close the incident and subsequently perform a postmortem. As with military combat, the goal is to be more effective and quicker to execute defensive actions than the adversary is able to attack

Front 70

What is OODA

Back 70

Observe, Orient, Decide, and Act (OODA) Loop.

Front 71

How many Incident report categories are there
A)7
B)9
C)8

Back 71

9

Front 72

What is category 1 for incident reporting and what precedence is it
A)Root Level Intrusion (Incident)
B)User Level Intrusion (Incident)
C)Explained Anomaly (Event)
D)Malicious Logic (Incident)

Back 72

Root Level Intrusion (Incident) Precedence 1

Front 73

What is category 2 for incident reporting and what precedence is it

Back 73

User Level Intrusion (Incident
Precedence 2

Front 74

What is category 3 for incident reporting and what precedence is it

Back 74

Unsuccessful Activity Attempt (Event)
Precedence 4

Front 75

What is category 4 for incident reportingand what precedence is it

Back 75

Denial of Service (Incident)
Precedence 3

Front 76

What is category 5 for incident reporting and what precedence is it

Back 76

Non-Compliance Activity (Event
Precedence 6

Front 77

What is category 6 for incident reporting and what precedence is it

Back 77

Reconnaissance (Event
Precedence 7

Front 78

What is category 7 for incident reporting and what precedence is it

Back 78

Malicious Logic (Incident)
Precedence 4

Front 79

What is category 8 for incident reporting and what precedence is it

Back 79

Investigating (Event)
Precedence 8

Front 80

What is category 9 for incident reporting and what precedence is it

Back 80

Explained Anomaly (Event)
Precedence 9

Front 81

What Topics do CJSM 6510.01A

Back 81

A – Incident Handling Program
B – Incident Handling Methodology C – Incident Reporting
D – Incident Analysis
E – Incident Response
F – Collaboration with Other Strategic Communities
G – CND Incident Handling Tools

Front 82

What are the two main types of reporting structures

Back 82

Technical Reporting Structure
Additional Reporting Structures

Front 83

Who falls under the technical reporting structure

Back 83

This structure consists primarily of Global USSTRATCOM (JTF-GNO) (Tier One), Regional/Theater/C/S/A (Tier Two) CNDSPs, and Local (Tier Three) organizations and describes the interactions between each of the Tier levels

Front 84

Which group falls under Additional Reporting structure

Back 84

This group includes other reporting structures that may be required in support of the IC, LE/CI, operational, and any other external organizations, as appropriate.

Front 85

What is DOD instruction 8500.2

Back 85

Information Assurance (IA) Implementation

Front 86

What is the purpose of DOD instruction 8500.2 Information Assurance (IA) Implementation

Back 86

Implements policy, assigns responsibilities, and prescribes procedures for applying integrated, layered protection of the DoD information systems and networks

Front 87

Who oversee implementation ofDOD instruction 8500.2

Back 87

Assistant Secretary of Defense

Front 88

IAW Information Assurance (IA) Implementation what are some roles of the Assistant secretary of Defense. Say all that apply
A)Manage the Defense-wide Information Assurance Program (DIAP) office
B)Publish the DoD CIO Annual IA Report
C)Provide oversight of DoD IA education, training, and awareness activities

Back 88

-Manage the Defense-wide Information Assurance Program (DIAP) office
-Publish the DoD CIO Annual IA Report
-Provide oversight of DoD IA education, training, and awareness activities

Front 89

True or False
The SOD maintain liaison with the office of the Intelligence Community (IC) Chief Information Officer (CIO) to ensure continuous coordination of DoD and IC IA activities and programs

Back 89

True