Question 1

Within what time frame does the HITECH Act require covered entities to notify affected individuals of a data breach of personal healthcare information?

Accepted Answer

A)  30 days 
B)  40 days 
C)  60 days 
D)  1 week 
A)  30 days 
B)  40 days 
C)  60 days 
D)  1 week C

Question 2

Which of the following best describes the detection and analysis phase of the NIST incident response process?

Accepted Answer

A)  Follows a predefined process while documenting each step the analyst takes 
B)  Includes deploying the necessary tools and resources to successfully investigate and resolve cybersecurity incidents 
C)  Includes how to use collected incident data and evidence retention 
D)  Includes choosing a containment strategy to effectively contain and eradicate the attack, as well as to successfully recover from it 
A)  Follows a predefined process while documenting each step the analyst takes 
B)  Includes deploying the necessary tools and resources to successfully investigate and resolve cybersecurity incidents 
C)  Includes how to use collected incident data and evidence retention 
D)  Includes choosing a containment strategy to effectively contain and eradicate the attack, as well as to successfully recover from it A

Question 3

Which of the following statements is not true?

Accepted Answer

A)  Employees should report all actual incidents. 
B)  Employees should report all suspected incidents. 
C)  Employees should assign a severity level when reporting incidents. 
D)  Employees should not be reprimanded if they report a perceived incident that ends up being a false positive. 
A)  Employees should report all actual incidents. 
B)  Employees should report all suspected incidents. 
C)  Employees should assign a severity level when reporting incidents. 
D)  Employees should not be reprimanded if they report a perceived incident that ends up being a false positive. C

Question 4

Which of the following regulations address the protection of personally identifiable information?

Accepted Answer

A)  HITECH 
B)  FISMA 
C)  GLBA 
D)  All of the above 
A)  HITECH 
B)  FISMA 
C)  GLBA 
D)  All of the above

Question 5

Which method of evidence preservation involves using a mesh of conducting material that prevents devices from communicating via Wi-Fi or cellular signals?

Accepted Answer

A)  Forensic image file 
B)  Chain of custody 
C)  Encryption 
D)  Faraday cage 
A)  Forensic image file 
B)  Chain of custody 
C)  Encryption 
D)  Faraday cage

Question 6

Which of the following is an example of a denial-of-service attack?

Accepted Answer

A)  Clicking a link in an e-mail that happens to contain malware 
B)  Installing a keylogger on a system in an attempt to collect usernames and passwords 
C)  Flooding a system with ping requests in an attempt to take it down 
D)  Viewing medical records to satisfy one's curiosity 
A)  Clicking a link in an e-mail that happens to contain malware 
B)  Installing a keylogger on a system in an attempt to collect usernames and passwords 
C)  Flooding a system with ping requests in an attempt to take it down 
D)  Viewing medical records to satisfy one's curiosity

Question 7

During the investigation and resolution of a security incident, you may also need to communicate with outside parties regarding the incident, such as which of the following?

Accepted Answer

A)  CSIRT 
B)  FS-ISAC 
C)  PSIRT 
D)  CERT 
A)  CSIRT 
B)  FS-ISAC 
C)  PSIRT 
D)  CERT

Question 8

CVSS is short for which of the following?

Accepted Answer

A)  Common Vulnerability Security System 
B)  Computer Vulnerability Scoring System 
C)  Computer Vulnerability Security System 
D)  Common Vulnerability Scoring System 
A)  Common Vulnerability Security System 
B)  Computer Vulnerability Scoring System 
C)  Computer Vulnerability Security System 
D)  Common Vulnerability Scoring System

Question 9

Which of the following best describes the preparation phase of the NIST incident response process?

Accepted Answer

A)  Follows a predefined process while documenting each step the analyst takes 
B)  Includes deploying the necessary tools and resources to successfully investigate and resolve cybersecurity incidents 
C)  Includes how to use collected incident data and evidence retention 
D)  Includes choosing a containment strategy to effectively contain and eradicate the attack, as well as to successfully recover from it 
A)  Follows a predefined process while documenting each step the analyst takes 
B)  Includes deploying the necessary tools and resources to successfully investigate and resolve cybersecurity incidents 
C)  Includes how to use collected incident data and evidence retention 
D)  Includes choosing a containment strategy to effectively contain and eradicate the attack, as well as to successfully recover from it

Question 10

Which of the following is an example of a Severity Level 3 incident?

Accepted Answer

A)  Malware detected on multiple systems 
B)  User's excessive use of bandwidth or resources 
C)  Compromise or suspected compromise of any company website or web presence 
D)  Compromise or suspected compromise of protected customer information 
A)  Malware detected on multiple systems 
B)  User's excessive use of bandwidth or resources 
C)  Compromise or suspected compromise of any company website or web presence 
D)  Compromise or suspected compromise of protected customer information

Question 11

Which of the following is an example of an intentional unauthorized access or use?

Accepted Answer

A)  Clicking a link in an e-mail that happens to contain malware 
B)  Installing a keylogger on a system in an attempt to collect usernames and passwords 
C)  Flooding a system with ping requests in an attempt to take it down 
D)  Viewing medical records to satisfy one's curiosity 
A)  Clicking a link in an e-mail that happens to contain malware 
B)  Installing a keylogger on a system in an attempt to collect usernames and passwords 
C)  Flooding a system with ping requests in an attempt to take it down 
D)  Viewing medical records to satisfy one's curiosity

Question 12

Which key incident management personnel represents the central point of contact for all incidents?

Accepted Answer

A)  Incident response coordinators 
B)  Designated incident handlers 
C)  Incident response team members 
D)  External advisors 
A)  Incident response coordinators 
B)  Designated incident handlers 
C)  Incident response team members 
D)  External advisors

Question 13

Which of the following is an example of a Severity Level 2 incident?

Accepted Answer

A)  Malware detected on multiple systems 
B)  User's excessive use of bandwidth or resources 
C)  Compromise or suspected compromise of any company website or web presence 
D)  Compromise or suspected compromise of protected customer information 
A)  Malware detected on multiple systems 
B)  User's excessive use of bandwidth or resources 
C)  Compromise or suspected compromise of any company website or web presence 
D)  Compromise or suspected compromise of protected customer information

Question 14

Which of the following are the steps in a digital forensic analysis according to NIST Special Publication 800-87?

Accepted Answer

A)  Collection, acquisition, security, reporting 
B)  Collection, examination, analysis, reporting 
C)  Collection, security, analysis, reporting 
D)  Collection, analysis, reporting, testifying 
A)  Collection, acquisition, security, reporting 
B)  Collection, examination, analysis, reporting 
C)  Collection, security, analysis, reporting 
D)  Collection, analysis, reporting, testifying

Question 15

Which of the following states does not have security breach law?

Accepted Answer

A)  California 
B)  Massachusetts 
C)  Texas 
D)  None of the above 
A)  California 
B)  Massachusetts 
C)  Texas 
D)  None of the above

Question 16

Which of the following is the final step for an incident response tabletop exercise?

Accepted Answer

A)  Execution 
B)  Preparation 
C)  Report 
D)  Analysis 
A)  Execution 
B)  Preparation 
C)  Report 
D)  Analysis

Question 17

Which of the following is an example of a Severity Level 1 incident?

Accepted Answer

A)  Inappropriate access to legally protected or proprietary information 
B)  Malware detected on multiple systems 
C)  User access to content or sites restricted by policy 
D)  Any act that is in direct violation of local, state, or federal law or regulation 
A)  Inappropriate access to legally protected or proprietary information 
B)  Malware detected on multiple systems 
C)  User access to content or sites restricted by policy 
D)  Any act that is in direct violation of local, state, or federal law or regulation

Question 18

Which of the following best describes the post-incident activity phase of the NIST incident response process?

Accepted Answer

A)  Follows a predefined process while documenting each step the analyst takes 
B)  Includes deploying the necessary tools and resources to successfully investigate and resolve cybersecurity incidents 
C)  Includes how to use collected incident data and evidence retention 
D)  Includes choosing a containment strategy to effectively contain and eradicate the attack, as well as to successfully recover from it 
A)  Follows a predefined process while documenting each step the analyst takes 
B)  Includes deploying the necessary tools and resources to successfully investigate and resolve cybersecurity incidents 
C)  Includes how to use collected incident data and evidence retention 
D)  Includes choosing a containment strategy to effectively contain and eradicate the attack, as well as to successfully recover from it

Question 19

Who must be notified of Severity Level 3 incidents?

Accepted Answer

A)  Chief Executive Officer 
B)  Chief Operating Officer 
C)  Chief Information Security Officer 
D)  Legal counsel 
A)  Chief Executive Officer 
B)  Chief Operating Officer 
C)  Chief Information Security Officer 
D)  Legal counsel

Question 20

A denial-of-service attack is considered which of the following?

Accepted Answer

A)  Severity Level 1 incident 
B)  Severity Level 2 incident 
C)  Severity Level 3 incident 
D)  Internal incident 
A)  Severity Level 1 incident 
B)  Severity Level 2 incident 
C)  Severity Level 3 incident 
D)  Internal incident

Within what time frame does the HITECH Act require covered entities to notify affected individuals of a data breach of personal healthcare information?

Which of the following best describes the detection and analysis phase of the NIST incident response process?

Which of the following statements is not true?

Which of the following regulations address the protection of personally identifiable information?

Which method of evidence preservation involves using a mesh of conducting material that prevents devices from communicating via Wi-Fi or cellular signals?

Which of the following is an example of a denial-of-service attack?

During the investigation and resolution of a security incident, you may also need to communicate with outside parties regarding the incident, such as which of the following?

CVSS is short for which of the following?

Which of the following best describes the preparation phase of the NIST incident response process?

Which of the following is an example of a Severity Level 3 incident?

Which of the following is an example of an intentional unauthorized access or use?

Which key incident management personnel represents the central point of contact for all incidents?

Which of the following is an example of a Severity Level 2 incident?

Which of the following are the steps in a digital forensic analysis according to NIST Special Publication 800-87?

Which of the following states does not have security breach law?

Which of the following is the final step for an incident response tabletop exercise?

Which of the following is an example of a Severity Level 1 incident?

Which of the following best describes the post-incident activity phase of the NIST incident response process?

Who must be notified of Severity Level 3 incidents?

A denial-of-service attack is considered which of the following?

Understanding Cybersecurity Policy and Governance

Cybersecurity Policy Organization, Format, and Styles

Cybersecurity Framework

Governance and Risk Management

Asset Management and Data Loss Prevention

Human Resources Security

Physical and Environmental Security

Communications and Operations Security

Access Control Management

Information Systems Acquisition, Development, and Maintenance

Business Continuity Management

Regulatory Compliance for Financial Institutions

Regulatory Compliance for the Health-Care Sector

PCI Compliance for Merchants

Nist Cybersecurity Framework

Filters

Exam 11: Cybersecurity Incident Response

Within what time frame does the HITECH Act require covered entities to notify affected individuals of a data breach of personal healthcare information?

Which of the following best describes the detection and analysis phase of the NIST incident response process?

Which of the following statements is not true?

Which of the following regulations address the protection of personally identifiable information?

Which method of evidence preservation involves using a mesh of conducting material that prevents devices from communicating via Wi-Fi or cellular signals?

Which of the following is an example of a denial-of-service attack?

During the investigation and resolution of a security incident, you may also need to communicate with outside parties regarding the incident, such as which of the following?

CVSS is short for which of the following?

Which of the following best describes the preparation phase of the NIST incident response process?

Which of the following is an example of a Severity Level 3 incident?

Which of the following is an example of an intentional unauthorized access or use?

Which key incident management personnel represents the central point of contact for all incidents?

Which of the following is an example of a Severity Level 2 incident?

Which of the following are the steps in a digital forensic analysis according to NIST Special Publication 800-87?

Which of the following states does not have security breach law?

Which of the following is the final step for an incident response tabletop exercise?

Which of the following is an example of a Severity Level 1 incident?

Which of the following best describes the post-incident activity phase of the NIST incident response process?

Who must be notified of Severity Level 3 incidents?

A denial-of-service attack is considered which of the following?

Understanding Cybersecurity Policy and Governance

Cybersecurity Policy Organization, Format, and Styles

Cybersecurity Framework

Governance and Risk Management

Asset Management and Data Loss Prevention

Human Resources Security

Physical and Environmental Security

Communications and Operations Security

Access Control Management

Information Systems Acquisition, Development, and Maintenance

Business Continuity Management

Regulatory Compliance for Financial Institutions

Regulatory Compliance for the Health-Care Sector

PCI Compliance for Merchants

Nist Cybersecurity Framework

Filters