Question 1

Organizations typically become aware of incidents through all the following except
A) Visible changes to services
B) Reports from file integrity monitoring tools
C) Periodic review meetings
D) Log analysis

Accepted Answer

Visible changes to services, reports from file integrity monitoring tools, and log analysis are all proactive methods of detecting incidents. Periodic review meetings may not specifically focus on incident detection, but rather on overall organizational performance and progress towards goals.

Question 2

Compliance is
A) A violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices
B) The act of following applicable laws, regulations, rules, industry codes and contractual obligations
C) The part of the incident response policy that specifies the targets of the policy
D) Staff designated to respond to incidents

Accepted Answer

Compliance refers to the act of adhering to applicable laws, regulations, rules, industry codes, and contractual obligations. It involves ensuring that an organization conducts its operations within legal and ethical boundaries, as well as follows established standards and guidelines. Choices A, C, and D refer to different aspects of incident response policy, which is related to but distinct from compliance.

Question 3

During an incident, the IRT is involved with all of the following, except
A) Identifying the threats to the organization from the incident
B) Mitigating risks
C) Communicating with stakeholders
D) Issuing a final report

Accepted Answer

C

Question 4

During an incident, it is advisable to pull members away from current projects to assist the IRT

Accepted Answer

During an incident, it is important to prioritize the response and allocate resources accordingly. Pulling members away from current projects to assist the incident response team (IRT) can help ensure a timely and effective response. It may also be necessary to notify management and stakeholders of the situation and the need for resources to be reallocated temporarily.

Question 5

Information about the incident should be disseminated
A) Exhaustively, to all constituents
B) Primarily to end users
C) Primarily to the organization's leadership
D) On a need-to-know basis

Accepted Answer

Disseminating information about an incident on a need-to-know basis ensures that sensitive information is not unnecessarily shared and minimizes the risk of further damage. Only those who need the information to carry out their roles should be given access to it.

Question 6

Since the incident response policy is developed following strict procedures including top management approval, its existence generally is an assurance that the organization will respond satisfactorily to an information security incident

Accepted Answer

While an incident response policy is crucial, its existence alone does not guarantee satisfactory response to an information security incident. Effective response also depends on proper implementation, regular training, and periodic testing of the policy.

Question 7

In the context of monitoring, a false positive is
A) An undetected problem
B) A component that is working intermittently
C) A component that is likely to fail soon
D) An alert that upon further investigation turns out to be not a problem

Accepted Answer

A false positive is an alert that is triggered indicating a problem, but upon further investigation, it is found that there is no actual issue. It is a common occurrence in monitoring systems and can lead to wasted time and resources if not properly addressed.

Question 8

According to the need-to-know principle of information management, information provided
A) Is limited to what is necessary to perform the job
B) Satisfies the information seeker's curiosity need-to-know
C) Is guided by state-mandated legal guidelines
D) Information is kept secret by default

Accepted Answer

The need-to-know principle of information management states that information should only be provided on a need-to-know basis, which means it should be limited to what is necessary to perform the job.

Question 9

In the context of monitoring, a false negative is
A) An undetected problem
B) A component that is working intermittently
C) A component that is likely to fail soon
D) An alert that upon further investigation turns out to be not a problem

Accepted Answer

A false negative in monitoring means that a problem or issue has gone undetected, which can be dangerous if left unnoticed.

Question 10

The IRT is
A) A violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices
B) The part of the incident response policy that specifies the targets of the policy
C) Staff designated to respond to incidents
D) The act of following applicable laws, regulations, rules, industry codes and contractual obligations

Accepted Answer

The IRT refers to the Incident Response Team, which is a staff designated to respond to incidents.

Option A refers to a security incident.

Option B refers to the scope of the incident response policy.

Option D refers to compliance with laws, regulations, rules, industry codes, and contractual obligations, which is not related to the IRT.

Question 11

Preparation for incident response includes all of the following except
A) Creating an incident response policy
B) Creating an incident response team
C) Containing the harm from an incident
D) Creating a communication plan during incidents

Accepted Answer

Preparation for incident response includes creating an incident response policy, creating an incident response team, and creating a communication plan during incidents. Containing the harm from an incident is not a preparation activity, but rather a response activity once an incident has occurred.

Question 12

The leader of the IRT is preferably
A) Someone from the senior leadership of the organization
B) A technically competent professional with high credibility within the organization
C) The functional leader of the business unit affected by the incident
D) The leader of the IT function within the organization

Accepted Answer

The leader of the IRT should be a technically competent professional with high credibility within the organization as they will be responsible for coordinating the investigation and response efforts across different teams and departments. They should also have experience dealing with incidents and be able to make quick and informed decisions. While someone from senior leadership or the functional leader of the affected business unit may have some involvement in the IRT, it is not necessarily the best fit for the overall leader role. The leader of the IT function may be involved in the response efforts, but may not have the necessary cross-functional experience or credibility within the organization to lead the IRT.

Question 13

The stages of incident handling include
A) Planning, detection, maintenance, retirement
B) Preparation, detection, containment, post-incident analysis
C) Planning, acquisition, deployment, post-incident analysis
D) Preparation, acquisition, deployment, post-incident analysis

Accepted Answer

The stages of incident handling are typically recognized as preparation, detection, containment, eradication, and post-incident analysis. Choice B is the only option that includes these stages, although it uses slightly different terminology (maintenance is replaced with eradication). Choices A, C, and D include some relevant steps (such as planning), but they do not include a complete set of incident handling stages.

Question 14

Files appropriate to monitor using file integrity monitoring tools include
A) End user data
B) Configuration files
C) Operating system files
D) Database contents

Accepted Answer

The answer of Files appropriate to monitor using file integrity...

Question 15

An incident response policy is
A) A description of the standard methods used by an organization to handle information security incidents
B) A description of security policies, acceptable use policies, or standard security practices
C) A specification of the targets of the policy
D) The act of following applicable laws, regulations, rules, industry codes and contractual obligations

Accepted Answer

An incident response policy is a set of guidelines and procedures that an organization follows when handling information security incidents. It outlines the steps that need to be taken to detect, investigate, mitigate, and recover from security incidents, as well as the roles and responsibilities of different stakeholders during the process. It also defines the procedures for reporting the incidents to management, stakeholders, and other relevant parties.

Question 16

Performance records of a machine are called
A) Configuration files
B) Sysadmin
C) Logs
D) Debian

Accepted Answer

Performance records of a machine are commonly referred to as logs. Logs record events or incidents on the system, including system errors, crashes, and unauthorized access attempts. This information can be used for troubleshooting and performance analysis. Configuration files (A) specify how software should behave, Sysadmin (B) refers to a system administrator who manages the system, and Debian (D) is a Linux-based operating system.

Question 17

An incident is
A) A violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices
B) The part of the incident response policy that specifies the targets of the policy
C) The act of following applicable laws, regulations, rules, industry codes and contractual obligations
D) Staff designated to respond to incidents

Accepted Answer

An incident refers to a violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices. This can include unauthorized access to systems, malware infections, and other security breaches.

Question 18

The technical members of the IRT are chosen
A) By rotation from the different departments in the organization
B) From the senior-most members of the IT teams
C) Depending upon the threat action
D) From the fresh entrants in the IT teams

Accepted Answer

The technical members of the IRT are not selected based on seniority or rotation from departments within the organization. Instead, they are chosen depending on the threat action that needs to be addressed. This ensures that the most skilled and experienced members are selected to handle each specific incident. Fresh entrants may not have enough experience to handle complex cybersecurity incidents. Therefore, option C is the best choice.

Question 19

The scope of an incident response policy is
A) A violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices
B) The act of following applicable laws, regulations, rules, industry codes and contractual obligations
C) Staff designated to respond to incidents
D) The part of the incident response policy that specifies the targets of the policy

Accepted Answer

The answer of The scope of an incident response policy...

Question 20

Log consolidation refers to
A) Recording the aggregation of credit cards
B) Checking logs from every system daily
C) Logging the system updates applied to the system
D) Gathering logs from multiple systems onto one system

Accepted Answer

Log consolidation refers to the process of gathering logs from multiple systems onto one central system. This allows for easier log management, analysis, and monitoring.

Quiz 11: Incident Handling

Organizations typically become aware of incidents through all the following except

Compliance is

During an incident, the IRT is involved with all of the following, except

During an incident, it is advisable to pull members away from current projects to assist the IRT

Information about the incident should be disseminated

Since the incident response policy is developed following strict procedures including top management approval, its existence generally is an assurance that the organization will respond satisfactorily to an information security incident

In the context of monitoring, a false positive is

According to the need-to-know principle of information management, information provided

In the context of monitoring, a false negative is

The IRT is

Preparation for incident response includes all of the following except

The leader of the IRT is preferably

The stages of incident handling include

Files appropriate to monitor using file integrity monitoring tools include

An incident response policy is

Performance records of a machine are called

An incident is

The technical members of the IRT are chosen

The scope of an incident response policy is

Log consolidation refers to