Deck 3: Planning for Contingencies

Question 1

An unusual system crash is a possible indicator of an actual incident.

Answer 1

True

Question 2

In a warm site,all communications services must be installed after the site is occupied.

Answer 2

False

Question 3

The presence of hacker tools in a system definitely signals that an incident is in progress or has occurred.

Answer 3

True

Question 4

Attack success scenarios include alternative outcomes of an attack.

Question 5

In most organizations,the COO is responsible for creating the IRP.

Question 6

A sequential system of activating an alert roster is more accurate than a hierarchical system.

Question 7

An organization should start documenting an incident after the incident has been contained.

Question 8

When an incident takes place,the disaster recovery plan (DRP)is invoked before the incident response plan (IRP).

Question 9

To perform parallel testing,the operations of the business must be halted.

Question 10

Incident recovery should begin after the incident has been contained.

Question 11

Continuous process improvement (CPI)suggests that each time the organization rehearses its plans,it should learn from the process,improve the process,and then rehearse again.

Question 12

The BCP is activated and executed concurrently with the DRP when the disaster is major or long term.

Question 13

A structured walk-through is the simplest kind of validation for reviewing the perceived feasibility and effectiveness of the contingency plan.

Question 14

Computer hardware and peripherals are provided in a cold site.

Question 15

The BCP is most properly managed by the CISO of an organization.

Question 16

A sequential system of activating an alert roster is quicker than a hierarchical system.

Question 17

The business continuity team detects,evaluates,and responds to disasters,and also reestablishes operations at the primary business site.

Question 18

Notification from IDS is a probable indicator of an actual incident.

Question 19

Verifying personnel status is a responsibility of the IR team.

Question 20

Classifying an incident is the responsibility of the IR team.

Question 21

A(n) $\text {\underline{ champion} }$

is an executive who supports,promotes,and endorses the findings of the CP project._________________________

Question 22

$\text {\underline{Parallel } }$
testing is the most rigorous strategy for testing contingency plans._________________________

Question 23

A(n)attack $\text {\underline{scenario } }$

consists of a detailed description of the activities that usually occur during an attack._________________________

Question 24

A(n) $\text {\underline{structured walk-through } }$

is a method of testing contingency plans in which each involved person works individually to simulate the performance of each task that he or she is responsible for._________________________

Question 25

A(n) $\text {\underline{hierarchical } }$
roster requires that a contact person call each and every person on the roster._________________________

Question 26

The BIA planning team estimates the cost of the best,worst,and most likely outcomes of an attack by preparing a(n) $\text {\underline{ attack scenario end case } }$

_________________________

Question 27

The $\text {\underline{ disaster recovery} }$

team is responsible for detecting,evaluating,and responding to disasters,and reestablishing operations at the primary business site._________________________

Question 28

A(n) $\text {\underline{ alert message} }$

is a scripted set of initial instructions used to respond to an incident._________________________

Question 29

The $\text {\underline{ IR Plan } }$

is the component of contingency planning that focuses on restoring operations at the primary site._________________________

Question 30

The concept that iteration results in improvement is implemented in the methodology of $\text {\underline{ continuous process improvement (CPI)} }$

._________________________

Question 31

The $\text {\underline{CP } }$

team manages and executes the incident response plan by detecting,evaluating,and responding to incidents._________________________

Question 32

In contingency planning,an unexpected,negative occurrence is called a(n) $\text {\underline{event. } }$

._________________________

Question 33

Changes to logs are $\text {\underline{probable } }$

indicators of an actual incident._________________________

Question 34

The $\text {\underline{ business impact analysis} }$

provides the CP team with information about systems and the threats they face._________________________

Question 35

$\text {\underline{Rapid-onset } }$

disasters occur suddenly,and may take the lives of people and destroy the means of production._________________________

Question 36

Activities at unexpected times are $\text {\underline{ probable} }$

indicators of an actual incident._________________________

Question 37

$\text {\underline{Electronic vaulting } }$

involves the transfer of live transactions to an off-site facility._________________________

Question 38

The process of examining a possible incident and determining whether it constitutes an actual incident is called incident $\text {\underline{ verification} }$
._________________________

Question 39

$\text {\underline{Crisis } }$

management entails a set of focused steps that deal primarily with the people involved in a disaster._________________________

Question 40

The presence of unfamiliar files is a(n) $\text {\underline{ definite} }$

indicator of an actual incident._________________________

Question 41

A scripted set of instructions about an incident is known as a(n)____.

A) incident report
B) incident summary
C) alert roster
D) alert message

Question 42

The three categories of incident indicators identified by D.L.Pipkin are possible,probable,and ____.

A) likely
B) improbable
C) definite
D) unlikely

Question 43

Operations at the primary business site are reestablished by the ____ team.

A) business continuity
B) CP
C) incident response
D) disaster recovery

Question 44

The ____ plan enables the business to continue to function at an alternate site.

A) FR
B) BC
C) IR
D) DR

Question 45

The IR Plan is usually activated ____.

A) before an incident takes place
B) when an incident is detected
C) once the DRP is activated
D) once the BCP is activated

Question 46

Which of the following is a possible indicator of an actual incident?

A) Unusual consumption of computing resources
B) Activities at unexpected times
C) Presence of hacker tools
D) Reported attacks

Question 47

A document that contains contact information on the individuals to be notified in the event of an actual incident is called a(n)____.

A) notification table
B) alert roster
C) notification list
D) response list

Question 48

Determining whether a possible incident is an actual incident is the responsibility of the ____ team.

A) CP
B) BC
C) DR
D) IR

Question 49

In a ____ activation,a single person calls all the people on the roster.

A) sequential
B) linear
C) random
D) hierarchical

Question 50

____ is the process of examining a possible incident and determining whether it constitutes an actual incident.

A) Incident classification
B) Incident identification
C) Incident registration
D) Incident verification

Question 51

In CP,an unexpected event is called a(n)____.

A) disaster
B) occurrence
C) episode
D) incident

Question 52

The ____ plan focuses on restoring operations at the primary site.

A) DR
B) IR
C) FR
D) BC

Question 53

In the event of an incident or disaster,the ____ team sets up and starts off-site operations.

A) CP
B) business continuity
C) disaster recovery
D) incident response

Question 54

The ____ plan focuses on the immediate response to an incident.

A) DR
B) IR
C) BC
D) FR

Question 55

Which of the following is a probable indicator of an actual incident?

A) Presence of unfamiliar files
B) Unusual system crashes
C) Presence of new accounts
D) Presence or execution of unknown programs

Question 56

Which of the following is a definite indicator of an actual incident?

A) Unusual system crashes
B) Reported attack
C) Presence of new accounts
D) Use of dormant accounts

Question 57

A ____ activation requires that the first person call designated people on the roster,who in turn call other designated people,and so on.

A) hierarchical
B) sequential
C) serial
D) random

Question 58

The two ways to activate an alert roster are sequentially and ____.

A) exponentially
B) dynamically
C) randomly
D) hierarchically

Question 59

The responsibility for creating an organization's IR Plan usually falls to the ____.

A) CIO
B) network administrators
C) security managers
D) CISO

Question 60

The ____ team collects information about information systems and the threats they face,and creates the contingency plans for incident response,disaster recovery,and business continuity.

A) incident response
B) CP
C) disaster recovery
D) business continuity

Question 61

The BC Plan is most properly managed by the ____.

A) CEO
B) CIO
C) CISO
D) IT community of interest

Question 62

____ ensures that critical business functions can continue if a disaster occurs.

A) Business continuity planning
B) Incident response planning
C) Disaster recovery planning
D) Crisis management planning

Question 63

A(n)____ determines the extent of the breach of confidentiality,integrity,and availability of information and information assets.

A) incident report
B) incident damage assessment
C) information loss assessment
D) damage report

Question 64

The DRP is usually managed by the ____.

A) CEO
B) COO
C) CISO
D) IT community of interest

Question 65

Which of the following is an example of a rapid-onset disaster?

A) Flood
B) Pest infestation
C) Famine
D) Environmental degradation

Question 66

Organizations located in coastal areas are more likely to experience ____ than organizations in other cities.

A) fires
B) earthquakes
C) tsunamis
D) cyberterrorism

Question 67

Dust contamination can ____.

A) damage the building that houses the information systems
B) shorten the lives of information systems
C) cause fires or other disasters
D) disrupt access to the building that houses the information systems

Question 68

Crisis management is designed to deal primarily with ____.

A) computer systems
B) network devices
C) network data
D) people

Question 69

Which of the following is an example of a slow-onset disaster?

A) Earthquake
B) Tornado
C) Mud flow
D) Pest infestation

Question 70

A ____ is a fully configured computer facility that needs only the latest data backups and the personnel to function.

A) hot site
B) warm site
C) cold site
D) service bureau

Question 71

A warm site ____.

A) includes software applications
B) includes computer equipment
C) can be fully functional within minutes
D) costs more than a hot site

Question 72

When a disaster threatens the viability of an organization at the primary site,the ____ is started.

A) crisis management process
B) business continuity process
C) incident response process
D) disaster recovery process

Question 73

Which of the following is a responsibility of the crisis management team?

A) Restoring the data from backups
B) Evaluating monitoring capabilities
C) Activating the alert roster
D) Restoring the services and processes in use

Question 74

A(n)____ entails a detailed examination of the events that occurred from first detection to final recovery.

A) alert message
B) alert roster
C) after-action review
D) incident damage assessment

Question 75

When dealing with an incident,the last action the IR team takes is to ____.

A) create the incident damage assessment
B) conduct an after-action review
C) restore data from backups
D) restore services and processes in use

Question 76

Which of the following is true about a hot site?

A) It is an empty room with standard heating, air conditioning, and electrical service.
B) It includes computing equipment and peripherals with servers but not client workstations.
C) It duplicates computing resources, peripherals, phone systems, applications, and workstations.
D) All communications services must be installed after the site is occupied.

Question 77

As part of DR plan readiness,each employee should have two types of ____ information cards in his or her possession at all times.

A) emergency
B) medical
C) insurance
D) lottery

Question 78

Which of the following can be fully functional within minutes?

A) A warm site
B) A hot site
C) A cold site
D) All of these

Question 79

No computer hardware or peripherals are provided in a ____.

A) cold site
B) warm site
C) timeshare
D) hot site

Question 80

Which of the following is a part of the incident recovery process?

A) Identifying the vulnerabilities that allowed the incident to occur and spread
B) Determining the event's impact on normal business operations and, if necessary, making a disaster declaration
C) Supporting personnel and their loved ones during the crisis
D) Keeping the public informed about the event and the actions being taken to ensure the recovery of personnel and the enterprise