Question 1

The ____ should contain the specific and detailed guidance and procedures for restoring lost or damaged capability.
A)forensic report
B)DR planning document
C)event schedule
D)contingency report

Accepted Answer

The DR planning document, or disaster recovery plan, is specifically designed to provide guidance and procedures for restoring lost or damaged capability. It should contain detailed steps and processes to ensure that systems and data are recovered in a timely and effective manner. A forensic report may provide information on the cause of the loss or damage, but it would not contain specific guidance for restoration. An event schedule or contingency report may be part of the DR planning document, but they do not provide the specific guidance and procedures needed for restoration.

Question 2

____ are likely in the event of a hacker attack,when the attacker retreats to a chat room and describes in specific detail to his or her associates the method and results of their latest conquest.
A)Follow-on incidents
B)War games
C)Black bag operations
D)Blue bag operations

Accepted Answer

Follow-on incidents are likely to occur when a hacker reveals their methods and results in a chat room, as it can inspire others to try and replicate the attack, leading to further incidents. War games refer to simulated attacks used for training and testing purposes. Black bag operations refer to illegal or covert actions used to obtain information, and blue bag operations refer to physical security practices for protecting sensitive information.

Question 3

____ may be caused by earthquakes,floods,storm winds,tornadoes,or mud flows.
A)Slow onset disasters
B)Communication disasters
C)Rapid onset disasters
D)Data disasters

Accepted Answer

Rapid onset disasters are sudden events that can cause immediate damage or loss of life, such as earthquakes, floods, storm winds, tornadoes, or mud flows. Slow onset disasters refer to events that develop gradually over time, such as droughts or desertification. Communication and data disasters are not typically associated with natural disasters.

Question 4

A ____ is owned by a single organization;it can be as small as two PCs attached to a single hub or it may support hundreds of users and multiple servers.
A)honeypot
B)cache
C)filter
D)LAN

Accepted Answer

LAN stands for Local Area Network and refers to a network that is owned and operated by a single organization. It can range in size from just a few connected devices to hundreds of users and multiple servers. A LAN is typically used for sharing resources, such as printers and files, and for enabling communication between devices within the organization.

Question 5

____ is the process of systematically examining information assets for evidentiary material that can provide insight into how an incident transpired.
A)After-action review
B)Hashing
C)Forensics analysis
D)Clustering

Accepted Answer

Forensics analysis is the process of systematically examining information assets for evidentiary material that can provide insight into how an incident transpired. After-action review is a debriefing process that occurs after an incident to identify lessons learned and areas for improvement. Hashing is a process of generating a unique fixed-size string of characters from a data input, typically used for data integrity verification. Clustering is a process of grouping data points or objects that are similar to each other.

Question 6

Web site ____ solutions should ensure the reliability and availability of the Web site and its resources.
A)security
B)contingency
C)maintenance
D)cache

Accepted Answer

Contingency solutions ensure the availability of the Web site and its resources, particularly in the event of unexpected downtime or outages. This can include backup servers, redundant systems, and failover mechanisms to ensure that the site remains up and running for users. While security solutions are important for protecting the site from attacks and maintaining the privacy of user data, and maintenance solutions help keep the site running smoothly over time, neither of these directly address reliability and availability in the same way that contingency solutions do. Cache solutions, while useful for improving site performance, do not directly address reliability or availability.

Question 7

____ occur over time and slowly deteriorate the capacity of an organization to withstand their effects.
A)Slow onset disasters
B)Communication disasters
C)Rapid onset disasters
D)Data disasters

Accepted Answer

Slow onset disasters occur gradually over time and can erode an organization's ability to prepare for and respond to them. Examples include climate change, economic decline, and social unrest. Communication, rapid onset, and data disasters are all types of disasters that have a more sudden and immediate impact.

Question 8

Data from the ____ of major applications and general support systems should be used to determine the recovery requirements and priorities to implement.
A)alert log
B)signature log
C)BIA
D)system log

Accepted Answer

The Business Impact Analysis (BIA) provides important data on the criticality of applications and systems to the organization, which can be used to determine recovery requirements and priorities. The alert log, signature log, and system log are logging mechanisms used for monitoring and troubleshooting purposes, but they do not provide information on recovery requirements.

Question 9

In disaster recovery,most triggers are in response to one or more natural events.

Accepted Answer

Natural events such as earthquakes, hurricanes, tornadoes, floods, and wildfires can trigger the need for disaster recovery efforts. However, triggers can also be the result of human-caused events such as cyber attacks, power outages, or physical damage to infrastructure.

Question 10

____ considerations for desktop and portable systems should emphasize data availability,confidentiality,and integrity.
A)Forensic
B)Contingency
C)Hashing
D)Black bag

Accepted Answer

Contingency considerations emphasize the importance of having a plan in place to ensure data availability, confidentiality, and integrity in the event of unexpected events or disasters that may compromise the security of the system. Forensic considerations relate to the collection and analysis of digital evidence, hashing refers to the use of cryptographic algorithms to ensure data integrity, and black bag operations refer to covert physical actions to gain access to a system, none of which directly relate to ensuring data availability, confidentiality, and integrity in desktop and portable systems.

Question 11

In disaster recovery,the ____ is the point at which a management decision to react is made in reaction to a notice or other data such as a weather report or an activity report from IT indicating the escalation of an incident.
A)mirrored site
B)hot site
C)cold site
D)trigger

Accepted Answer

The point at which a management decision to react is made in reaction to a notice or other data is called a trigger. Mirrored site, hot site, and cold site are all different types of disaster recovery sites and not relevant to this specific question.

Question 12

The purpose of the disaster recovery program is to provide for the direction and guidance of any and all disaster recovery operations.

Accepted Answer

The purpose of the disaster recovery program is indeed to provide direction and guidance for any disaster recovery operations that may be required.

Question 13

Natural disasters such as earthquakes can usually be mitigated with multipurpose casualty insurance.

Accepted Answer

Multipurpose casualty insurance typically covers losses due to events such as accidents, theft, and liability claims, but not natural disasters such as earthquakes. Specific insurance policies, such as earthquake insurance, may need to be purchased to mitigate losses from natural disasters.

Question 14

Before returning to routine duties,the IR team must also conduct a(n)____.
A)chain of custody
B)after-action review
C)war game
D)Alarm Compaction

Accepted Answer

An after-action review is a critical step in the incident response process. It allows the IR team to evaluate their performance, identify areas for improvement, and document any lessons learned. Conducting an after-action review helps ensure that the organization is better prepared to respond to future incidents. While the other options listed may be important tasks for the IR team to complete, they are not essential before returning to routine duties.

Question 15

____ are those that occur suddenly,with little warning,taking the lives of people and destroying the means of production.
A)Slow onset disasters
B)Communication disasters
C)Rapid onset disasters
D)Data disasters

Accepted Answer

Rapid onset disasters are sudden and unexpected, with little to no warning, and can cause immediate loss of life and destruction of infrastructure and means of production. Examples include earthquakes, tsunamis, hurricanes, and terrorist attacks.

Question 16

____ support file sharing and storage,data processing,central application hosting (such as e-mail or a central database),printing,access control,user authentication,remote access connectivity,and other shared network services.
A)Servers
B)Honeypots
C)Filters
D)Clusters

Accepted Answer

Servers are specifically designed to support and provide various network services such as file sharing and storage, data processing, printing, user authentication, and remote access connectivity. They are capable of hosting central applications like email or databases, enabling access control, and providing shared network services to different users. Honeypots, filters, and clusters are not specifically designed for providing these services.

Question 17

Once the incident has been contained,and all signs of the incident removed,the ____ phase begins.
A)actions after
B)black bag operation
C)chain of custody
D)blue bag operation

Accepted Answer

The Actions After phase refers to the steps and procedures taken after the incident has been contained and all signs of the incident removed. This phase includes analyzing the incident, reviewing procedures, identifying areas for improvement, and taking corrective actions. The other options, Black Bag Operation, Chain of Custody, and Blue Bag Operation, do not relate to the post-incident phase.

Question 18

A WAN that hosts a mission-critical distributed system may require a more complete and robust recovery strategy than a WAN that connects multiple LANs for simple resource sharing purposes.

Accepted Answer

A mission-critical distributed system requires a higher level of availability and continuity than a simple resource-sharing LAN. Consequently, a more elaborate and resilient recovery strategy may be required to ensure the smooth operation of the WAN.

Question 19

____ are highly probable when infected machines are brought back online or when other infected computers that may have been offline at the time of the attack are brought back up.
A)Follow-on incidents
B)War games
C)Black bag operations
D)Blue bag operations

Accepted Answer

Follow-on incidents refer to the continued impact of a cyberattack even after the initial infection has been identified and contained. When infected machines are brought back online or other previously offline machines are brought back up, there is a high probability of follow-on incidents occurring, such as reinfection or further spread of the malware.

Question 20

When selecting an off-site storage location for data backups or stored equipment,extra care should be taken to increase the risk at that storage location.

Accepted Answer

It should be "decrease" instead of "increase". Extra care should be taken to decrease the risk at the storage location to ensure the safety of the data backups or stored equipment.

Quiz 7: Disaster Recovery: Preparation and Implementation

The ____ should contain the specific and detailed guidance and procedures for restoring lost or damaged capability.

____ are likely in the event of a hacker attack,when the attacker retreats to a chat room and describes in specific detail to his or her associates the method and results of their latest conquest.

____ may be caused by earthquakes,floods,storm winds,tornadoes,or mud flows.

A ____ is owned by a single organization;it can be as small as two PCs attached to a single hub or it may support hundreds of users and multiple servers.

____ is the process of systematically examining information assets for evidentiary material that can provide insight into how an incident transpired.

Web site ____ solutions should ensure the reliability and availability of the Web site and its resources.

____ occur over time and slowly deteriorate the capacity of an organization to withstand their effects.

Data from the ____ of major applications and general support systems should be used to determine the recovery requirements and priorities to implement.

In disaster recovery,most triggers are in response to one or more natural events.

____ considerations for desktop and portable systems should emphasize data availability,confidentiality,and integrity.

In disaster recovery,the ____ is the point at which a management decision to react is made in reaction to a notice or other data such as a weather report or an activity report from IT indicating the escalation of an incident.

The purpose of the disaster recovery program is to provide for the direction and guidance of any and all disaster recovery operations.

Natural disasters such as earthquakes can usually be mitigated with multipurpose casualty insurance.

Before returning to routine duties,the IR team must also conduct a(n) ____.

____ are those that occur suddenly,with little warning,taking the lives of people and destroying the means of production.

____ support file sharing and storage,data processing,central application hosting (such as e-mail or a central database) ,printing,access control,user authentication,remote access connectivity,and other shared network services.

Once the incident has been contained,and all signs of the incident removed,the ____ phase begins.

A WAN that hosts a mission-critical distributed system may require a more complete and robust recovery strategy than a WAN that connects multiple LANs for simple resource sharing purposes.

____ are highly probable when infected machines are brought back online or when other infected computers that may have been offline at the time of the attack are brought back up.

When selecting an off-site storage location for data backups or stored equipment,extra care should be taken to increase the risk at that storage location.