Deck 10: Planning for Contingencies

Question 1

Using standard digital forensics methodology,the first step is to analyze the EM data without risking modification or unauthorized access.

Answer 1

False

Question 2

Training should be as specialized as possible; personnel who are responsible for one duty should not be trained on other duties to avoid confusion during a disaster.

Answer 2

False

Question 3

Which of the following is a possible indicator of an actual incident?

A) Unusual consumption of computing resources
B) Activities at unexpected times
C) Presence of hacker tools
D) Reported attacks

Answer 3

A

Question 4

Analert digest is a description of the incident or disaster that usually contains just enoughinformation so that each person knows what portion of the IR or DR plan to implement withoutslowing down the notification process.____________

Question 5

A(n)wrap-up review is a detailedexamination and discussion of the events that occurred duringan incident or disaster,from first detection to final recovery.____________

Question 6

Which is the first step in the contingency planning process among the options listed here?

A) Business continuity training
B) Disaster recovery planning
C) Business impact analysis
D) Incident response planning

Question 7

Aslow-onset disaster is a disaster that occurs over time and gradually degrade the capacity of anorganization to withstand their effects.____________

Question 8

Which of the following has the main goal of restoring normal modes of operation with minimal cost and disruption to normal business activities after an adverse event?

A) Risk management
B) Contingency planning
C) Business response
D) Disaster readiness

Question 9

Disaster classification is the process of examining an adverse event or incident and determiningwhether it constitutes an actual disaster.____________

Question 10

An item does not become evidence until it is formally admitted to evidence by a judge or other ruling official.

Question 11

In a warm site,all services and communications links are fully configured and the site can be fully functional within minutes.

Question 12

Which of the following is a mathematical tool that can be useful in assessing relative importance while resolving the issue of what business function is the most critical?

A) Weighted analysis
B) BIA questionnaire
C) Recovery time organizer
D) MTD comparison

Question 13

Which of the following is the process of examining a possible incident and determining whether it constitutes an actual incident?

A) Incident classification
B) Incident identification
C) Incident registration
D) Incident verification

Question 14

When performing simlation testing,normal operations of the business are not impacted.

Question 15

Patch and proceed is anorganizational CP philosophy that focuses on the defense ofinformation assets and preventing reoccurrence rather than the attacker's identification andprosecution.____________

Question 16

In the event of an incident or disaster,which planning element is used to guide off-site operations?

A) Project management
B) Business continuity
C) Disaster recovery
D) Incident response

Question 17

In most organizations,the COO is responsible for creating the IR plan.

Question 18

What is the final stage of the business impact analysis when using the NIST SP 800-34 approach?

A) Identify resource requirements
B) Identify business processes
C) Determine mission/business processes and recovery criticality
D) Identify recovery priorities for system resources

Question 19

At what point in the incident lifecycle is the IR plan initiated?

A) Before an incident takes place
B) Once the DRP is activated
C) When an incident is detectedthataffects it
D) Once the BCP is activated

Question 20

When an incident takes place,the disaster recovery (DR)planis invoked before the incident response (IR)plan.

Question 21

In which contingency plan testing strategy do individuals participate in a role-playing exercise inwhich the CP team is presented with a scenario of an actual incident or disaster and expected to react as if it had occurred?

A) Desk check
B) Simulation
C) Structured walk-through
D) Parallel testing

Question 22

Which of the following is the transfer of live transactions to an off-site facility?

A) Remote journaling
B) Electronic vaulting
C) Database shadowing
D) Timesharing

Question 23

In digital forensics,all investigations follow the same basic methodology.Which of the following should be performed first in a digital forensics investigation?

A) Report the findings to the proper authority
B) Acquire (seize) the evidence without alteration or damage
C) Identify relevant items of evidentiary value (EM)
D) Analyze the data without risking modification or unauthorized access

Question 24

Which of the following is an approachavailable to an organization as an overall philosophy for contingency planning reactions?

A) Protect and forget
B) after-action review
C) Transfer to local/state/federal law enforcement
D) Track, hack and prosecute

Question 25

The four components of contingency planning are the ____________________,the incident response plan,the disaster recovery plan,and the business continuity plan.

Question 26

In which contingency plan testing strategy do individuals follow each and every IR/DR/BC procedure,including the interruption of service,restoration of data from backups,and notification of appropriate individuals?

A) Desk check
B) Simulation
C) Structured walk-through
D) Full-interruption

Question 27

Which of the following is a responsibility of the crisis management team?

A) Restoring the data from backups
B) Evaluating monitoring capabilities
C) Keeping the public informed about the event and the actions being taken
D) Restoring the services and processes in use

Question 28

When a disaster renders the current business location unusable,which plan is put into action?

A) Business continuity
B) Crisis management
C) Incident response
D) Business impact analysis

Question 29

Which of the following is true about a hot site?

A) It is an empty room with standard heating, air conditioning, and electrical service.
B) It includes computing equipment and peripherals with servers but not client workstations.
C) It duplicates computing resources, peripherals, phone systems, applications, and workstations.
D) All communications services must be installed after the site is occupied.

Question 30

After an incident,but before returning to its normal duties,the CSIRT must do which of the following?

A) Create the incident damage assessment
B) Conduct an after-action review
C) Restore data from backups
D) Restore services and processes in use

Question 31

If operations at the primary site cannot be quickly restored,the ____________________ occurs concurrently with the DR plan,enabling the business to continue at an alternate site.

Question 32

Which of the following determines the scope of the breach of confidentiality,integrity,and availability of information and information assets?

A) Incident report
B) Incident damage assessment
C) Information loss assessment
D) Damage report

Question 33

In which type of site are no computer hardware or peripherals provided?

A) Cold site
B) Warm site
C) Timeshare
D) Hot site

Question 34

Which of the following is a part of the incident recovery process?

A) Identifying the vulnerabilities that allowed the incident to occur and spread
B) Determining the event's impact on normal business operations and, if necessary, making a disaster declaration
C) Supporting personnel and their loved ones during the crisis
D) Keeping the public informed about the event and the actions being taken to ensure the recovery of personnel and the enterprise

Question 35

Which type of document grants formal permission for an investigation to occur?

A) Affidavit
B) Search warrant
C) Evidentiary report
D) Forensic concurrence

Question 36

Which of the following is a definite indicator of an actual incident?

A) Unusual system crashes
B) Reported attack
C) Presence of new accounts
D) Use of dormant accounts

Question 37

Which of the following allows investigators to determine what happened by examining the results of an event-criminal,natural,intentional,or accidental?

A) Digital malfeasance
B) E-discovery
C) Forensics
D) Evidentiary procedures

Question 38

Which document must be changed when evidence changes hands or is stored?

A) Chain of custody
B) Search warrant
C) Affidavit
D) Evidentiary material

Question 39

Which of the following is usually conducted via leased lines or secure Internet connections whereby the receiving server archives the data as it is received?.

A) Database shadowing
B) Timesharing
C) Traditional backups
D) Electronic vaulting

Question 40

Which of the following is the best example of a rapid-onset disaster?

A) Flood
B) Pest infestation
C) Famine
D) Environmental degradation

Question 41

When undertaking the BIA,whatshouldthe organization consider?

Question 42

The ____________________ plan is a detailed set of processes and procedures that anticipate,detect,and mitigate the effects of an unexpected event that might compromise information resources and assets.

Question 43

A(n)____________________ occurs when an attack affects information resources and/or assets,causing actual damage or other disruptions.

Question 44

What teams are involved in contingency planning and contingency operations?

Question 45

List four of the eight key components of a typical IR policy.

Question 46

Describe the methodology an organization should follow in an investigation.

Question 47

Compare and contrast a hot site,a warm site,and a cold site.

Question 48

In ____________________ testing of contingency plans,the individuals follow each and every procedure,including the interruption of service,restoration of data from backups,and notification of appropriate individuals.

Question 49

When dealing with an incident,the incident response team must conduct a(n)____________________,which entails a detailed examination of the events that occurred from first detection to final recovery.

Question 50

Discuss three of the five strategies that can be used to test contingency strategies.

Question 51

The bulk batch-transfer of data to an off-site facility is known as ____________________.

Question 52

List the seven steps of the incident recovery process according to Donald Pipkin.

Question 53

There are six key elements that the CP team must build into the DR Plan.What are three of them?

Question 54

What are the major components of contingency planning?

Question 55

The first component of the analysis phase of a digital forensic investigation is ___________,which allows the investigator to quickly and easily search for a specific type of file.

Question 56

A(n)____________________ is an agency that provides,in the case of DR/BC planning,physical facilities for a fee.

Question 57

____________________ planning ensures that critical business functions can continue if a disaster occurs.

Question 58

What are the three roles performed by the crisis management team?

Question 59

Explain the difference between a business impact analysis and the risk management process.

Question 60

A(n)____________________ is a document containing contact information of the individuals to notify in the event of an actual incident.