Deck 11: Contingency Planning and Networking Incident Response

Question 1

NAS works well with real-time applications because of the latency of the communication methods.

Answer 1

False

Question 2

____ planning ensures that critical business functions can continue if a disaster occurs.

A) Business response
C) Incident response
B) Business continuity planning
D) Disaster recovery

Answer 2

B

Question 3

A(n) ____ backup is the storage of all files that have changed or have been added since the last full backup.

A) full
C) incremental
B) half
D) differential

Answer 3

D

Question 4

The actions an organization should take while an incident is in progress are defined in a document referred to as the ____ plan.

A) business response (BR)
C) incident response (IR)
B) business impact analysis (BIA)
D) disaster recovery (DR)

Question 5

____ are the representative collection of individuals with a stake in the successful and uninterrupted operation of the organization's information infrastructure.

A) Product developers
C) Incident responders
B) Stakeholders
D) Vendors

Question 6

Incident response focuses on immediate response to small-scale events.

Question 7

Which backup method allows for easy full-system restorations (no shuffling through tapes with partial backups on them)?

A) RAID
C) Grandfather-Father-Son (GFS)
B) The Towers of Hanoi
D) Six-tape rotation

Question 8

The key role of a(n) ____ is defining how to reestablish operations at the location where the organization usually operates.

A) business response (BR)
C) incident response (IR)
B) business impact analysis (BIA)
D) disaster recovery (DR)

Question 9

RAID is a replacement for backup and recovery processes.

Question 10

The bulk transfer of data in batches to an off-site facility is called ____.

A) electronic vaulting
C) bare metal recovery
B) server clustering
D) remote journaling

Question 11

A(n) ____ is any clearly identified attack on the organization's information assets that would threaten the assets' confidentiality, integrity, or availability.

A) event
C) trigger
B) incident
D) RAID occurrence

Question 12

The business impact analysis (BIA) is the first major component of the CP process.

Question 13

____ techniques are generally used by organizations needing immediate data recovery after an incident or disaster.

A) Shadowing
C) Bare metal recovery
B) Clustering
D) Journaling

Question 14

In some organizations, which two plans are considered to be one plan, known as the Business Resumption Plan?

A) BIA plan and BC plan
C) DR plan and IR plan
B) IR plan and BC plan
D) DR plan and BC plan

Question 15

____ clustering is a more complex model in which all members of a cluster simultaneously provide application services.

A) Passive/active
C) Active/passive
B) Passive/passive
D) Active/active

Question 16

The final phase of the IR planning function is plan maintenance.

Question 17

____ is the transfer of live transactions to an off-site facility.

A) Electronic vaulting
C) Bare metal recovery
B) Server clustering
D) Remote journaling

Question 18

What is a drawback of tape backups?

A) Time required to store and retrieve information
B) Cost of the media
C) Limited selection of the media
D) Small size of the tape media capacity

Question 19

Which team is responsible for conducting the BIA?

A) CP Management Team (CPMT)
C) Incident response (IR) team
B) Business continuity (BC) team
D) Disaster recovery (DR) team

Question 20

Which cloud type acts as a collaboration between a few entities for the sole benefit of those entities?

A) Common clouds
C) Public clouds
B) Community clouds
D) Private clouds

Question 21

A(n) ____________________ backup only archives the data that have been modified since the last backup (regardless of type), and thus requires less space and time than a differential backup.

Question 22

Incident ____ is the process of evaluating organizational events, determining which events are possible incidents, also called incident candidates, and then determining whether or not the incident candidate is an actual incident or a nonevent, also called a false positive incident candidate.

A) identification
C) vulnerability
B) journal
D) classification

Question 23

The ____, which is also known as the Security Incident Response Team (SIRT), is the group of individuals who would be expected to respond to a detected incident.

A) CP Management Team (CPMT)
B) disaster recovery (DR) team
C) Computer Security Incident Response Team (CSIRT)
D) business continuity (BC) team

Question 24

Match each item with a statement below.
a.RAID Level 0
f.RAID Level 5
b.RAID Level 1
g.RAID Level 6
c.RAID Level 2
h.RAID Level 7
d.RAID Level 3
i.RAID Level 10
e.RAID Level 4
Is most commonly used in organizations that balance safety and redundancy against the costs of acquiring and operating the systems.

Question 25

Match each item with a statement below.
a.RAID Level 0
f.RAID Level 5
b.RAID Level 1
g.RAID Level 6
c.RAID Level 2
h.RAID Level 7
d.RAID Level 3
i.RAID Level 10
e.RAID Level 4
A specialized form of disk striping with parity; is not widely used

Question 26

According to D. L. Pipkin, ____ is a definite indicator of an actual incident.

A) notification from intrusion detection system (IDS)
B) activities at unexpected times
C) use of dormant accounts
D) presence of new accounts

Question 27

The identification of an incident begins with the ____________________ - that is, the circumstances that cause the IR team to be activated and the IR plan to be initiated.

Question 28

The ____ review entails a detailed examination of the events that occurred from first detection to final recovery.

A) after-action
C) desk check
B) incident classification
D) structured walk-through

Question 29

____________________ are the contractual documents guaranteeing certain minimum levels of service provided by vendors.

Question 30

Match each item with a statement below.
a.RAID Level 0
f.RAID Level 5
b.RAID Level 1
g.RAID Level 6
c.RAID Level 2
h.RAID Level 7
d.RAID Level 3
i.RAID Level 10
e.RAID Level 4
Commonly called disk mirroring

Question 31

Match each item with a statement below.
a.RAID Level 0
f.RAID Level 5
b.RAID Level 1
g.RAID Level 6
c.RAID Level 2
h.RAID Level 7
d.RAID Level 3
i.RAID Level 10
e.RAID Level 4
Uses block-level striping of data

Question 32

Which strategy to test contingency plans involves team members acting as defenders, using their own equipment or a duplicate environment, against realistic attacks executed by external information security professionals?

A) Parallel testing
C) Simulation
B) War gaming
D) Structured walk-through

Question 33

Match each item with a statement below.
a.RAID Level 0
f.RAID Level 5
b.RAID Level 1
g.RAID Level 6
c.RAID Level 2
h.RAID Level 7
d.RAID Level 3
i.RAID Level 10
e.RAID Level 4
Often called disk striping without parity

Question 34

Match each item with a statement below.
a.RAID Level 0
f.RAID Level 5
b.RAID Level 1
g.RAID Level 6
c.RAID Level 2
h.RAID Level 7
d.RAID Level 3
i.RAID Level 10
e.RAID Level 4
Uses byte-level striping of data

Question 35

____________________ is the process by which the information technology and information security teams position their organizations to prepare for, detect, react to, and recover from man-made or natural events that threaten the security of information resources and assets.

Question 36

Match each item with a statement below.
a.RAID Level 0
f.RAID Level 5
b.RAID Level 1
g.RAID Level 6
c.RAID Level 2
h.RAID Level 7
d.RAID Level 3
i.RAID Level 10
e.RAID Level 4
Is very similar to RAID 5; however, this level adds another layer of parity data striped across the drives

Question 37

Database ____________________ is the propagation of transactions to a remote copy of the database.

Question 38

A(n) ____ is a detailed description of the activities that occur during an attack, including the preliminary indications of the attack as well as the actions taken and the outcome.

A) trigger
C) event
B) database journal
D) attack profile

Question 39

Match each item with a statement below.
a.RAID Level 0
f.RAID Level 5
b.RAID Level 1
g.RAID Level 6
c.RAID Level 2
h.RAID Level 7
d.RAID Level 3
i.RAID Level 10
e.RAID Level 4
A proprietary variation on RAID 5 in which the array works as a single virtual drive

Question 40

Match each item with a statement below.
a.RAID Level 0
f.RAID Level 5
b.RAID Level 1
g.RAID Level 6
c.RAID Level 2
h.RAID Level 7
d.RAID Level 3
i.RAID Level 10
e.RAID Level 4
Referred to as RAID 1+0, which combines the benefits of RAID 0 and RAID 1

Question 41

List five good information security practices that prevent attacks on the desktop.

Question 42

Describe the two criteria that may cause a disaster occurrence.

Question 43

Describe the Grandfather-Father-Son (GFS) backup method.

Question 44

List the four integrated contingency planning (CP) components.

Question 45

According to NIST Special Publication 800-34 Rev.1, what are the three distinct phases an organization goes through when reacting to an event that is determined to pose a threat to the organization?

Question 46

Compare the protect and forget strategy with the apprehend and prosecute strategy.

Question 47

What are the two key facets of incident detection?

Question 48

Describe a strategy for implementing server recovery and redundancy through mirroring servers.

Question 49

Compare a sequential roster to a hierarchical roster.

Question 50

Describe the three forms of cloud computing.