Question 1

An IDS is a ________ control.

Accepted Answer

A)  preventative 
B)  detective 
C)  restorative 
D)  All of the above 
A)  preventative 
B)  detective 
C)  restorative 
D)  All of the above

Question 2

Incident response is defined as reacting to incidents impromptu.

Accepted Answer

A) True 
 B)False

Question 3

Who should head the CSIRT?

Accepted Answer

A)  IT 
B)  IT security 
C)  A senior manager 
D)  None of the above 
A)  IT 
B)  IT security 
C)  A senior manager 
D)  None of the above

Question 4

If a defendant has already been prosecuted in a criminal trial, he or she cannot later be tried in a civil trial.

Accepted Answer

A) True 
 B)False

Question 5

The only person who should speak on behalf of a firm should be ________.

Accepted Answer

A)  the public relations director 
B)  the firm's legal counsel 
C)  Both A and B 
D)  Neither A nor B 
A)  the public relations director 
B)  the firm's legal counsel 
C)  Both A and B 
D)  Neither A nor B

Question 6

The normal standard for deciding a case in ________ trials is guilt beyond a reasonable doubt.

Accepted Answer

A)  civil 
B)  criminal 
C)  Both A and B 
D)  Neither A nor B 
A)  civil 
B)  criminal 
C)  Both A and B 
D)  Neither A nor B

Question 7

________ of response is critical.

Accepted Answer

A)  Accuracy 
B)  Speed 
C)  Both A and B 
D)  Neither A nor B 
A)  Accuracy 
B)  Speed 
C)  Both A and B 
D)  Neither A nor B

Question 8

In an IDS, ________ means that the IDS should report all attacks events and report as few false alarms as possible.

Accepted Answer

A)  precision 
B)  event correlation 
C)  Both A and B 
D)  Neither A nor B 
A)  precision 
B)  event correlation 
C)  Both A and B 
D)  Neither A nor B

Question 9

________ specify how a company will maintain or restore core business operations after disasters.

Accepted Answer

A)  Business continuity plans 
B)  IT disaster recovery plans 
C)  Both A and B 
D)  Neither A nor B 
A)  Business continuity plans 
B)  IT disaster recovery plans 
C)  Both A and B 
D)  Neither A nor B

Question 10

False alarms in an IDS are known as ________.

Accepted Answer

A)  false positives 
B)  false negatives 
C)  pranks 
D)  noise 
A)  false positives 
B)  false negatives 
C)  pranks 
D)  noise

Question 11

Restoration of data files from tape ________.

Accepted Answer

A)  is the fastest recovery method 
B)  always results in data loss 
C)  Both A and B 
D)  Neither A nor B 
A)  is the fastest recovery method 
B)  always results in data loss 
C)  Both A and B 
D)  Neither A nor B

Question 12

A NIDS can ________.

Accepted Answer

A)  see all packets passing through its position in a network 
B)  scan encrypted data 
C)  Both A and B 
D)  Neither A nor B 
A)  see all packets passing through its position in a network 
B)  scan encrypted data 
C)  Both A and B 
D)  Neither A nor B

Question 13

IDS false alarms cause ________.

Accepted Answer

A)  companies to ignore IDS alerts 
B)  companies to install multiple IDSs using different methods 
C)  Both A and B 
D)  Neither A nor B 
A)  companies to ignore IDS alerts 
B)  companies to install multiple IDSs using different methods 
C)  Both A and B 
D)  Neither A nor B

Question 14

Disconnection ________.

Accepted Answer

A)  is the most decisive way to do termination 
B)  harms legitimate users 
C)  Both A and B 
D)  Neither A nor B 
A)  is the most decisive way to do termination 
B)  harms legitimate users 
C)  Both A and B 
D)  Neither A nor B

Question 15

What protection can a firm provide for people in the event of an emergency?

Accepted Answer

A)  Not allowing people to go into an unsafe environment 
B)  Accounting for all staff immediately 
C)  Both A and B 
D)  Neither A nor B 
A)  Not allowing people to go into an unsafe environment 
B)  Accounting for all staff immediately 
C)  Both A and B 
D)  Neither A nor B

Question 16

18 U.S.C. § 1030 protects ________.

Accepted Answer

A)  all computers 
B)  "protected computers" such as government computers 
C)  Both A and B 
D)  Neither A nor B 
A)  all computers 
B)  "protected computers" such as government computers 
C)  Both A and B 
D)  Neither A nor B

Question 17

Rehearsals improve ________.

Accepted Answer

A)  accuracy 
B)  speed 
C)  Both A and B 
D)  Neither A nor B 
A)  accuracy 
B)  speed 
C)  Both A and B 
D)  Neither A nor B

Question 18

Precedents can be created by ________.

Accepted Answer

A)  U.S. Circuit Courts of Appeal. 
B)  U.S. District Courts 
C)  Both A and B 
D)  Neither A nor B 
A)  U.S. Circuit Courts of Appeal. 
B)  U.S. District Courts 
C)  Both A and B 
D)  Neither A nor B

Question 19

Black holing is an effective long-term containment solution.

Accepted Answer

A) True 
 B)False

Question 20

Live tests are ________.

Accepted Answer

A)  more effective than walkthroughs 
B)  inexpensive 
C)  Both A and B 
D)  Neither A nor B 
A)  more effective than walkthroughs 
B)  inexpensive 
C)  Both A and B 
D)  Neither A nor B

An IDS is a ________ control.

Incident response is defined as reacting to incidents impromptu.

Who should head the CSIRT?

If a defendant has already been prosecuted in a criminal trial, he or she cannot later be tried in a civil trial.

The only person who should speak on behalf of a firm should be ________.

The normal standard for deciding a case in ________ trials is guilt beyond a reasonable doubt.

________ of response is critical.

In an IDS, ________ means that the IDS should report all attacks events and report as few false alarms as possible.

________ specify how a company will maintain or restore core business operations after disasters.

False alarms in an IDS are known as ________.

Restoration of data files from tape ________.

A NIDS can ________.

IDS false alarms cause ________.

Disconnection ________.

What protection can a firm provide for people in the event of an emergency?

18 U.S.C. § 1030 protects ________.

Rehearsals improve ________.

Precedents can be created by ________.

Black holing is an effective long-term containment solution.

Live tests are ________.

The Threat Environment

Planning and Policy

Cryptography

Secure Networks

Access Control

Firewalls

Host Hardening

Application Security

Data Protection

Module A: Networking Concepts

Filters

Exam 10: Incident and Disaster Response

An IDS is a ________ control.

Incident response is defined as reacting to incidents impromptu.

Who should head the CSIRT?

If a defendant has already been prosecuted in a criminal trial, he or she cannot later be tried in a civil trial.

The only person who should speak on behalf of a firm should be ________.

The normal standard for deciding a case in ________ trials is guilt beyond a reasonable doubt.

________ of response is critical.

In an IDS, ________ means that the IDS should report all attacks events and report as few false alarms as possible.

________ specify how a company will maintain or restore core business operations after disasters.

False alarms in an IDS are known as ________.

Restoration of data files from tape ________.

A NIDS can ________.

IDS false alarms cause ________.

Disconnection ________.

What protection can a firm provide for people in the event of an emergency?

18 U.S.C. § 1030 protects ________.

Rehearsals improve ________.

Precedents can be created by ________.

Black holing is an effective long-term containment solution.

Live tests are ________.

The Threat Environment

Planning and Policy

Cryptography

Secure Networks

Access Control

Firewalls

Host Hardening

Application Security

Data Protection

Module A: Networking Concepts

Filters