Deck 10: Incident and Disaster Response

Question 1

________ of response is critical.

A) Accuracy
B) Speed
C) Both A and B
D) Neither A nor B

Answer 1

C

Question 2

With good planning and protection, a company can eliminate security incidents.

Answer 2

False

Question 3

A CSIRT should not include members from the legal department.

Answer 3

False

Question 4

Live tests are ________.

A) more effective than walkthroughs
B) inexpensive
C) Both A and B
D) Neither A nor B

Question 5

Rehearsals improve ________.

A) accuracy
B) speed
C) Both A and B
D) Neither A nor B

Question 6

The business continuity team should be headed by ________.

A) a senior business manager
B) the chief information officer
C) the chief security officer
D) None of the above

Question 7

Walkthroughs are better than live tests because walkthroughs can reveal subtleties that live tests may miss.

Question 8

A major security incident is generally handled by the ________.

A) IT disaster response team
B) business continuity team
C) CSIRT
D) All of the above

Question 9

A CSIRT should include members from the public relations department.

Question 10

Which of the following is not one of the four security levels of incidents?

A) False alarms
B) Minor incidents
C) Virus epidemics
D) Disasters

Question 11

Walkthroughs are ________ table-top exercises.

A) better than
B) just as good as
C) worse than
D) the same thing as

Question 12

A walkthrough is also called a ________.

A) table-top exercise
B) live test
C) Both A and B
D) Neither A nor B

Question 13

Incident response is defined as reacting to incidents according to plan.

Question 14

Wal-Mart was able to respond to hurricane Katrina so quickly because it had ________.

A) detailed business continuity plans
B) a full-time director of business continuity
C) Both A and B
D) Neither A nor B

Question 15

False positives are legitimate activities that are flagged as suspicious.

Question 16

Successful attacks are commonly called ________.

A) security incidents
B) countermeasures
C) Both A and B
D) Neither A nor B

Question 17

________ is concerned with the restarting of the day-to-day revenue generating operations of the firm.

A) Business continuity planning
B) IT disaster recovery
C) Both A and B
D) Neither A nor B

Question 18

________ is the act of passing an incident to the CSIRT or business continuity team.

A) Transference
B) Escalation
C) Delegation
D) Acceleration

Question 19

________ allows a response team to determine an incident's damage potential and to gather information needed to begin containment and recovery.

A) Detection
B) Analysis
C) Both A and B
D) Neither A nor B

Question 20

Incident response is defined as reacting to incidents impromptu.

Question 21

Once an attack has begun, a company should never allow the attacker to continue.

Question 22

If it can be applied, the least-damaging recovery option is ________.

A) restoration from backup tapes
B) total reinstallation
C) repair during continuing server operation
D) All of the above are about equally damaging

Question 23

________ is the act of actually stopping an incident's damage.

A) Disconnection
B) Gapping
C) Containment
D) Termination

Question 24

Restoration of data files from tape ________.

A) is the fastest recovery method
B) always results in data loss
C) Both A and B
D) Neither A nor B

Question 25

Repair during ongoing server operation is ________.

A) desirable
B) dangerous
C) Both A and B
D) Neither A nor B

Question 26

The decision to let an attack continue should be made by ________.

A) IT
B) IT security
C) senior business executives
D) public relations

Question 27

Black holing is an effective long-term containment solution.

Question 28

________ eliminates the problem of having to re-baseline the system to proper security levels.

A) Using a disk image
B) Total software reinstallation
C) Both A and B
D) Neither A nor B

Question 29

________ deals with interpretations of rights and duties that companies or individuals have relative to each other.

A) Criminal law
B) Civil law
C) Both A and B
D) Neither A nor B

Question 30

The only person who should speak on behalf of a firm should be ________.

A) the public relations director
B) the firm's legal counsel
C) Both A and B
D) Neither A nor B

Question 31

Which of the following should the CSIRT include?

A) senior manager
B) PR director
C) firm's legal counsel
D) All of the above

Question 32

It is easier to punish employees than to prosecute outside attackers.

Question 33

Disconnection ________.

A) is the most decisive way to do termination
B) harms legitimate users
C) Both A and B
D) Neither A nor B

Question 34

Which of the following is not one of the three rules for apologies?

A) Explain what happened.
B) Acknowledge responsibility and harm.
C) Use wording aimed at reducing lawsuits.
D) Explain what action will be taken to compensate victims, if any.

Question 35

________ investigate(s) most violations of local and state computer laws.

A) Local police
B) The FBI
C) Both A and B
D) Neither A nor B

Question 36

Who should head the CSIRT?

A) IT
B) IT security
C) A senior manager
D) None of the above

Question 37

Total software reinstallation effectively addresses data loss.

Question 38

________ evidence is evidence that is acceptable for court proceedings.

A) Title 18
B) Title 11
C) Forensic
D) Expert

Question 39

Dropping all future packets from a particular IP address is called ________.

A) black holing
B) disconnection
C) IP address spoofing
D) damaging

Question 40

Allowing an attacker to continue working in a system after the attack has been discovered ________.

A) may allow the company to collect evidence for prosecution
B) can be dangerous by allowing the attacker to do more damage
C) Both A and B
D) Neither A nor B

Question 41

Only an expert witness is allowed to interpret facts for juries.

Question 42

A(n) ________ is a professional who is trained to collect and evaluate computer evidence in ways that are likely to be admissible in court.

A) expert witness
B) computer forensics expert
C) Both A and B
D) Neither A nor B

Question 43

________ punishments may result in fines.

A) Criminal
B) Civil
C) Both A and B
D) Neither A nor B

Question 44

A ________ is law dealing with information technology.

A) cyberlaw
B) Title 13
C) Title 17
D) All of the above

Question 45

The prosecutor must demonstrate ________ at the time of the action at the center of a criminal trial.

A) reasonable doubt
B) mens rea
C) Both A and B
D) Neither A nor B

Question 46

Plaintiffs initiate legal proceedings in ________ cases.

A) civil
B) criminal
C) Both A and B
D) Neither A nor B

Question 47

Which of the following is not one of the three levels of U.S. federal courts?

A) U.S. District Courts
B) U.S. Circuit Courts of Appeal
C) U.S. State Courts
D) The U.S. Supreme Court

Question 48

Courts will often admit unreliable evidence if judges believe that juries can be trusted to evaluate it properly.

Question 49

If a defendant has already been prosecuted in a criminal trial, he or she cannot later be tried in a civil trial.

Question 50

Mens Rea usually is important is ________ trials.

A) civil
B) criminal
C) Both A and B
D) Neither A nor B

Question 51

Federal jurisdiction typically does not extend to computer crimes that are committed entirely within a state and that do not have a bearing on interstate commerce.

Question 52

Past judicial precedents constitute ________.

A) case law
B) statutes
C) criminal law
D) All of the above

Question 53

The normal standard for deciding a case in ________ trials is a preponderance of the evidence.

A) civil
B) criminal
C) Both A and B
D) Neither A nor B

Question 54

Precedents can be created by ________.

A) U.S. Circuit Courts of Appeal.
B) U.S. District Courts
C) Both A and B
D) Neither A nor B

Question 55

________ punishments may result in jail time.

A) Criminal
B) Civil
C) Both A and B
D) Neither A nor B

Question 56

________ are areas of responsibility within which different government bodies can make and enforce laws but beyond which they cannot.

A) Mens rea
B) Jurisdictions
C) Statutes
D) Precedents

Question 57

Prosecutors initiate legal proceedings in ________ cases.

A) civil
B) criminal
C) Both A and B
D) Neither A nor B

Question 58

The normal standard for deciding a case in ________ trials is guilt beyond a reasonable doubt.

A) civil
B) criminal
C) Both A and B
D) Neither A nor B

Question 59

________ deals with the violation of criminal statutes.

A) Criminal law
B) Civil law
C) Both A and B
D) Neither A nor B

Question 60

International laws about cybercrime are fairly uniform.

Question 61

Communication between IDS ________ must be secure.

A) managers and agents
B) vendors and managers
C) Both A and B
D) Neither A nor B

Question 62

Interactive log file analysis can filter out irrelevant entries.

Question 63

In ________ transfers, the agent waits until it has several minutes or several hours of data and then sends a block of log file data to the manager.

A) batch
B) real-time
C) Both A and B
D) Neither A nor B

Question 64

Which of the following is a function of IDSs?

A) Strike-back
B) Automated analysis
C) Both A and B
D) Neither A nor B

Question 65

False alarms in an IDS are known as ________.

A) false positives
B) false negatives
C) pranks
D) noise

Question 66

In ________ transfers, each event's data goes to the manager immediately.

A) batch
B) real-time
C) Both A and B
D) Neither A nor B

Question 67

What information should alarms give the security staff?

A) A way to test the alarm for accuracy
B) Advice about what the security administrator should do
C) Both A and B
D) Neither A nor B

Question 68

18 U.S.C. § 1030 prohibits hacking.

Question 69

18 U.S.C. § 2511 prohibits ________.

A) the interception of electronic messages
B) hacking
C) Both A and B
D) Neither A nor B

Question 70

IDS false alarms cause ________.

A) companies to ignore IDS alerts
B) companies to install multiple IDSs using different methods
C) Both A and B
D) Neither A nor B

Question 71

The ________ is responsible for integrating the information from the multiple agents that run on multiple monitoring devices.

A) manager
B) agent
C) Both A and B
D) Neither A nor B

Question 72

An IDS provides query and reporting tools to help administrators analyze the data interactively during and after an incident.

Question 73

The ________ collects event data and stores them in log files on the monitoring devices.

A) manager
B) agent
C) Both A and B
D) Neither A nor B

Question 74

NIDs look at ________.

A) all host traffic in a network
B) all network traffic in a network
C) Both A and B
D) Neither A nor B

Question 75

18 U.S.C. § 1030 protects ________.

A) all computers
B) "protected computers" such as government computers
C) Both A and B
D) Neither A nor B

Question 76

An IDS is a ________ control.

A) preventative
B) detective
C) restorative
D) All of the above

Question 77

A router can be a NIDS.

Question 78

Which type of analysis do IDSs usually do?

A) Attack signature detection
B) Anomaly detection
C) Both A and B
D) Neither A nor B

Question 79

A ________ IDS sends data from many devices at a central management console.

A) centralized
B) distributed
C) fragmented
D) decentralized

Question 80

18 U.S.C. § 1030 prohibits ________.

A) hacking
B) malware attacks
C) denial-of-service attacks
D) All of the above