Question 1

In which contingency plan testing strategy do individuals participate in a role-playing exercise inwhich the CP team is presented with a scenario of an actual incident or disaster and expected to react as if it had occurred?

Accepted Answer

In a simulation, the CP team is presented with a scenario of an actual incident or disaster and expected to react as if it had occurred through a role-playing exercise. This type of testing provides a realistic environment to test the plan and assess the team's ability to respond effectively. Desk check involves reviewing the plan without executing it, structured walk-through involves a step-by-step analysis of the plan, and parallel testing involves running the plan and the primary system simultaneously to ensure compatibility.

Question 2

Which of the following is the transfer of live transactions to an off-site facility?

Accepted Answer

Remote journaling involves the transfer of live transaction data to an off-site facility for backup and recovery purposes.

Question 3

In digital forensics,all investigations follow the same basic methodology.Which of the following should be performed first in a digital forensics investigation?

Accepted Answer

The first step in a digital forensics investigation is to identify relevant items of evidentiary value, as this sets the scope for the subsequent steps of acquiring, analyzing, and reporting.

Question 4

Which of the following is an approachavailable to an organization as an overall philosophy for contingency planning reactions?

Accepted Answer

The "protect and forget" approach is a philosophy where an organization focuses on protecting its assets and then moves on without pursuing further action, such as legal prosecution or tracking down the perpetrator.

Question 5

The four components of contingency planning are the ____________________,the incident response plan,the disaster recovery plan,and the business continuity plan.

Accepted Answer

The answer of The four components of contingency planning are...

Question 6

In which contingency plan testing strategy do individuals follow each and every IR/DR/BC procedure,including the interruption of service,restoration of data from backups,and notification of appropriate individuals?

Accepted Answer

Full-interruption testing involves completely interrupting the service or system, and thoroughly testing each and every IR/DR/BC procedure, including the restoration of data from backups as well as notification of appropriate individuals. This type of testing provides the most realistic and thorough assessment of the contingency plan's effectiveness, but can also be the most disruptive and costly.

Question 7

Which of the following is a responsibility of the crisis management team?

Accepted Answer

Keeping the public informed about the event and the actions being taken is a key responsibility of the crisis management team. Restoring data from backups and restoring services and processes in use are technical tasks that may be done by IT personnel, and evaluating monitoring capabilities is more likely to be the responsibility of the security team.

Question 8

When a disaster renders the current business location unusable,which plan is put into action?

Accepted Answer

When a disaster renders the current business location unusable, the appropriate plan to put into action would be the business continuity plan, which outlines steps for maintaining essential business functions and operations during and after a disruption. The crisis management plan focuses on how to respond to and manage a crisis or emergency situation, while the incident response plan outlines actions for handling and resolving specific types of incidents such as security breaches or natural disasters. The business impact analysis is a process for assessing potential risks and losses to the business from various scenarios.

Question 9

Which of the following is true about a hot site?

Accepted Answer

A hot site is a fully functional secondary site equipped with all necessary computing resources, peripherals, phone systems, applications, and workstations. It is designed to duplicate the primary site's computing environment in case of a disaster or outage. Option A is incorrect because a hot site is not just an empty room with standard utilities. Option B is incorrect because a hot site includes both servers and client workstations. Option D is incorrect because all necessary communications services should already be installed before occupying a hot site.

Question 10

After an incident,but before returning to its normal duties,the CSIRT must do which of the following?

Accepted Answer

Before returning to normal duties, conducting an after-action review (AAR) is crucial to assess what went wrong during the incident and to identify any areas that need improvement. This will help the CSIRT to better respond to future incidents. While restoring data and services is important, they should be done following the AAR. The incident damage assessment should have been done earlier during the incident response process.

Question 11

If operations at the primary site cannot be quickly restored,the ____________________ occurs concurrently with the DR plan,enabling the business to continue at an alternate site.

Accepted Answer

The answer of If operations at the primary site cannot...

Question 12

Which of the following determines the scope of the breach of confidentiality,integrity,and availability of information and information assets?

Accepted Answer

The scope of the breach of confidentiality, integrity, and availability of information and information assets is determined by conducting an incident damage assessment. This assessment involves identifying the extent of the damage caused by the incident, the types of information and assets affected, and the potential impact on the organization. A damage report may be generated as part of this assessment, but it is not the best choice because it only focuses on the damages incurred and not the scope of the breach. An incident report is also not the best choice because it usually only includes details about the incident itself, not the scope of the damage. An information loss assessment, while important, is not the best choice because it only focuses on information loss and not the scope of the breach in terms of confidentiality, integrity, and availability.

Question 13

In which type of site are no computer hardware or peripherals provided?

Accepted Answer

A cold site is a type of disaster recovery site that does not have any computer hardware or peripherals installed. It is essentially an empty space where a company can set up its own equipment in the event of a disaster.

Question 14

Which of the following is a part of the incident recovery process?

Accepted Answer

Identifying vulnerabilities is a crucial step in the incident recovery process to prevent future incidents.

Question 15

Which type of document grants formal permission for an investigation to occur?

Accepted Answer

A search warrant is a legal document issued by a judge or magistrate authorizing law enforcement officers to conduct a search of a person, home, vehicle, or other property. It grants formal permission to investigate and seize evidence.

Question 16

Which of the following is a definite indicator of an actual incident?

Accepted Answer

The answer of Which of the following is a definite...

Question 17

Which of the following allows investigators to determine what happened by examining the results of an event-criminal,natural,intentional,or accidental?

Accepted Answer

Forensics is the process of examining and analyzing evidence to determine what happened during an event, whether it was criminal, natural, intentional, or accidental. This can involve digital forensics, which is the examination of digital devices and evidence, as well as other types of forensics such as ballistics, fingerprint analysis, and DNA analysis. Options A, B, and D do not specifically refer to the process of examining evidence to determine what happened, making them incorrect choices.

Question 18

Which document must be changed when evidence changes hands or is stored?

Accepted Answer

The chain of custody document must be updated every time evidence changes hands or is stored to ensure that the integrity of the evidence is maintained and that it is admissible in court.

Question 19

Which of the following is usually conducted via leased lines or secure Internet connections whereby the receiving server archives the data as it is received?.

Accepted Answer

Electronic vaulting is the process of sending backup data to a remote location over leased lines or secure Internet connections. The receiving server archives the data in real-time as it is received. This provides an off-site backup location in case of a disaster or system failure. Choices A, B, and C do not involve the real-time archiving of data to a remote location.

Question 20

Which of the following is the best example of a rapid-onset disaster?

Accepted Answer

A flood is a rapid-onset disaster because it can occur suddenly and without warning, causing significant damage and loss of life within a short period of time. Pest infestations, famine, and environmental degradation typically develop more gradually over time.

Quiz 10: Planning for Contingencies