Question 1

18 U.S.C. § 2511 prohibits ________.

Accepted Answer

A)  the interception of electronic messages 
B)  hacking 
C)  Both A and B 
D)  Neither A nor B 
A)  the interception of electronic messages 
B)  hacking 
C)  Both A and B 
D)  Neither A nor B

Question 2

Walkthroughs are better than live tests because walkthroughs can reveal subtleties that live tests may miss.

Accepted Answer

A) True 
 B)False

Question 3

Host operating system monitors look at ________.

Accepted Answer

A)  multiple failed logins 
B)  creating new accounts 
C)  Both A and B 
D)  Neither A nor B 
A)  multiple failed logins 
B)  creating new accounts 
C)  Both A and B 
D)  Neither A nor B

Question 4

Communication between IDS ________ must be secure.

Accepted Answer

A)  managers and agents 
B)  vendors and managers 
C)  Both A and B 
D)  Neither A nor B 
A)  managers and agents 
B)  vendors and managers 
C)  Both A and B 
D)  Neither A nor B

Question 5

Traffic in a honeypot usually indicates an attack.

Accepted Answer

A) True 
 B)False

Question 6

Integrated log files ________.

Accepted Answer

A)  tend to have problems with format incompatibilities 
B)  tend to have time synchronization problems 
C)  Both A and B 
D)  Neither A nor B 
A)  tend to have problems with format incompatibilities 
B)  tend to have time synchronization problems 
C)  Both A and B 
D)  Neither A nor B

Question 7

In a crisis, rigid adherence to plans and processes for recovery is critical.

Accepted Answer

A) True 
 B)False

Question 8

Integrated log files ________.

Accepted Answer

A)  tend to have problems with format incompatibilities 
B)  tend to have time synchronization problems 
C)  Both A and B 
D)  Neither A nor B 
A)  tend to have problems with format incompatibilities 
B)  tend to have time synchronization problems 
C)  Both A and B 
D)  Neither A nor B

Question 9

Prosecutors initiate legal proceedings in ________ cases.

Accepted Answer

A)  civil 
B)  criminal 
C)  Both A and B 
D)  Neither A nor B 
A)  civil 
B)  criminal 
C)  Both A and B 
D)  Neither A nor B

Question 10

A major security incident is generally handled by the ________.

Accepted Answer

A)  IT disaster response team 
B)  business continuity team 
C)  CSIRT 
D)  All of the above 
A)  IT disaster response team 
B)  business continuity team 
C)  CSIRT 
D)  All of the above

Question 11

________ evidence is evidence that is acceptable for court proceedings.

Accepted Answer

A)  Title 18 
B)  Title 11 
C)  Forensic 
D)  Expert 
A)  Title 18 
B)  Title 11 
C)  Forensic 
D)  Expert

Question 12

Walkthroughs are ________ table-top exercises.

Accepted Answer

A)  better than 
B)  just as good as 
C)  worse than 
D)  the same thing as 
A)  better than 
B)  just as good as 
C)  worse than 
D)  the same thing as

Question 13

When a system runs out of storage space, ________.

Accepted Answer

A)  new events are not saved 
B)  the IDS will start a new log file 
C)  Both A and B 
D)  Neither A nor B 
A)  new events are not saved 
B)  the IDS will start a new log file 
C)  Both A and B 
D)  Neither A nor B

Question 14

In ________ transfers, the agent waits until it has several minutes or several hours of data and then sends a block of log file data to the manager.

Accepted Answer

A)  batch 
B)  real-time 
C)  Both A and B 
D)  Neither A nor B 
A)  batch 
B)  real-time 
C)  Both A and B 
D)  Neither A nor B

Question 15

Which of the following is the most effective alternative for disaster recovery backup?

Accepted Answer

A)  Hot sites 
B)  Cold sites 
C)  CDP 
D)  All of the above 
A)  Hot sites 
B)  Cold sites 
C)  CDP 
D)  All of the above

Question 16

________ is the act of actually stopping an incident's damage.

Accepted Answer

A)  Disconnection 
B)  Gapping 
C)  Containment 
D)  Termination 
A)  Disconnection 
B)  Gapping 
C)  Containment 
D)  Termination

Question 17

Which of the following is not one of the four security levels of incidents?

Accepted Answer

A)  False alarms 
B)  Minor incidents 
C)  Virus epidemics 
D)  Disasters 
A)  False alarms 
B)  Minor incidents 
C)  Virus epidemics 
D)  Disasters

Question 18

Rehearsing IT disaster recovery procedures is essential to improve response speed and accuracy.

Accepted Answer

A) True 
 B)False

Question 19

Dropping all future packets from a particular IP address is called ________.

Accepted Answer

A)  black holing 
B)  disconnection 
C)  IP address spoofing 
D)  damaging 
A)  black holing 
B)  disconnection 
C)  IP address spoofing 
D)  damaging

Question 20

The decision to let an attack continue should be made by ________.

Accepted Answer

A)  IT 
B)  IT security 
C)  senior business executives 
D)  public relations 
A)  IT 
B)  IT security 
C)  senior business executives 
D)  public relations

18 U.S.C. § 2511 prohibits ________.

Walkthroughs are better than live tests because walkthroughs can reveal subtleties that live tests may miss.

Host operating system monitors look at ________.

Communication between IDS ________ must be secure.

Traffic in a honeypot usually indicates an attack.

Integrated log files ________.

In a crisis, rigid adherence to plans and processes for recovery is critical.

Integrated log files ________.

Prosecutors initiate legal proceedings in ________ cases.

A major security incident is generally handled by the ________.

________ evidence is evidence that is acceptable for court proceedings.

Walkthroughs are ________ table-top exercises.

When a system runs out of storage space, ________.

In ________ transfers, the agent waits until it has several minutes or several hours of data and then sends a block of log file data to the manager.

Which of the following is the most effective alternative for disaster recovery backup?

________ is the act of actually stopping an incident's damage.

Which of the following is not one of the four security levels of incidents?

Rehearsing IT disaster recovery procedures is essential to improve response speed and accuracy.

Dropping all future packets from a particular IP address is called ________.

The decision to let an attack continue should be made by ________.

The Threat Environment

Planning and Policy

Cryptography

Secure Networks

Access Control

Firewalls

Host Hardening

Application Security

Data Protection

Module A: Networking Concepts

Filters

Exam 10: Incident and Disaster Response

18 U.S.C. § 2511 prohibits ________.

Walkthroughs are better than live tests because walkthroughs can reveal subtleties that live tests may miss.

Host operating system monitors look at ________.

Communication between IDS ________ must be secure.

Traffic in a honeypot usually indicates an attack.

Integrated log files ________.

In a crisis, rigid adherence to plans and processes for recovery is critical.

Integrated log files ________.

Prosecutors initiate legal proceedings in ________ cases.

A major security incident is generally handled by the ________.

________ evidence is evidence that is acceptable for court proceedings.

Walkthroughs are ________ table-top exercises.

When a system runs out of storage space, ________.

In ________ transfers, the agent waits until it has several minutes or several hours of data and then sends a block of log file data to the manager.

Which of the following is the most effective alternative for disaster recovery backup?

________ is the act of actually stopping an incident's damage.

Which of the following is not one of the four security levels of incidents?

Rehearsing IT disaster recovery procedures is essential to improve response speed and accuracy.

Dropping all future packets from a particular IP address is called ________.

The decision to let an attack continue should be made by ________.

The Threat Environment

Planning and Policy

Cryptography

Secure Networks

Access Control

Firewalls

Host Hardening

Application Security

Data Protection

Module A: Networking Concepts

Filters