Question 1

NIDs look at ________.

Accepted Answer

A)  all host traffic in a network 
B)  all network traffic in a network 
C)  Both A and B 
D)  Neither A nor B 
A)  all host traffic in a network 
B)  all network traffic in a network 
C)  Both A and B 
D)  Neither A nor B

Question 2

Incident response is defined as reacting to incidents according to plan.

Accepted Answer

A) True 
 B)False

Question 3

HIDSs ________.

Accepted Answer

A)  provide highly specific information about what happened on a particular host 
B)  cannot be compromised by hacking the host 
C)  Both A and B 
D)  Neither A nor B 
A)  provide highly specific information about what happened on a particular host 
B)  cannot be compromised by hacking the host 
C)  Both A and B 
D)  Neither A nor B

Question 4

Repair during ongoing server operation is ________.

Accepted Answer

A)  desirable 
B)  dangerous 
C)  Both A and B 
D)  Neither A nor B 
A)  desirable 
B)  dangerous 
C)  Both A and B 
D)  Neither A nor B

Question 5

A walkthrough is also called a ________.

Accepted Answer

A)  table-top exercise 
B)  live test 
C)  Both A and B 
D)  Neither A nor B 
A)  table-top exercise 
B)  live test 
C)  Both A and B 
D)  Neither A nor B

Question 6

Which of the following is not one of the three levels of U.S. federal courts?

Accepted Answer

A)  U.S. District Courts 
B)  U.S. Circuit Courts of Appeal 
C)  U.S. State Courts 
D)  The U.S. Supreme Court 
A)  U.S. District Courts 
B)  U.S. Circuit Courts of Appeal 
C)  U.S. State Courts 
D)  The U.S. Supreme Court

Question 7

The prosecutor must demonstrate ________ at the time of the action at the center of a criminal trial.

Accepted Answer

A)  reasonable doubt 
B)  mens rea 
C)  Both A and B 
D)  Neither A nor B 
A)  reasonable doubt 
B)  mens rea 
C)  Both A and B 
D)  Neither A nor B

Question 8

A ________ is law dealing with information technology.

Accepted Answer

A)  cyberlaw 
B)  Title 13 
C)  Title 17 
D)  All of the above 
A)  cyberlaw 
B)  Title 13 
C)  Title 17 
D)  All of the above

Question 9

A ________ is a fake network segment with multiple clients and servers.

Accepted Answer

A)  trap 
B)  honeypot 
C)  IDS 
D)  virtual network 
A)  trap 
B)  honeypot 
C)  IDS 
D)  virtual network

Question 10

What information should alarms give the security staff?

Accepted Answer

A)  A way to test the alarm for accuracy 
B)  Advice about what the security administrator should do 
C)  Both A and B 
D)  Neither A nor B 
A)  A way to test the alarm for accuracy 
B)  Advice about what the security administrator should do 
C)  Both A and B 
D)  Neither A nor B

Question 11

The ________ collects event data and stores them in log files on the monitoring devices.

Accepted Answer

A)  manager 
B)  agent 
C)  Both A and B 
D)  Neither A nor B 
A)  manager 
B)  agent 
C)  Both A and B 
D)  Neither A nor B

Question 12

False positives are legitimate activities that are flagged as suspicious.

Accepted Answer

A) True 
 B)False

Question 13

Plaintiffs initiate legal proceedings in ________ cases.

Accepted Answer

A)  civil 
B)  criminal 
C)  Both A and B 
D)  Neither A nor B 
A)  civil 
B)  criminal 
C)  Both A and B 
D)  Neither A nor B

Question 14

Total software reinstallation effectively addresses data loss.

Accepted Answer

A) True 
 B)False

Question 15

Which of the following should the CSIRT include?

Accepted Answer

A)  senior manager 
B)  PR director 
C)  firm's legal counsel 
D)  All of the above 
A)  senior manager 
B)  PR director 
C)  firm's legal counsel 
D)  All of the above

Question 16

________ specify how a company will restore IT functions after a disaster.

Accepted Answer

A)  Business continuity plans 
B)  IT disaster recovery plans 
C)  Both A and B 
D)  Neither A nor B 
A)  Business continuity plans 
B)  IT disaster recovery plans 
C)  Both A and B 
D)  Neither A nor B

Question 17

Companies achieve time synchronization for integrated log files by using ________.

Accepted Answer

A)  the Greenwich mean time protocol 
B)  the Network Time Protocol 
C)  Both A and B 
D)  Neither A nor B 
A)  the Greenwich mean time protocol 
B)  the Network Time Protocol 
C)  Both A and B 
D)  Neither A nor B

Question 18

If an IDS cannot process all of the packets it receives, it will ________ packets it cannot process.

Accepted Answer

A)  drop 
B)  pass 
C)  quarantine 
D)  None of the above 
A)  drop 
B)  pass 
C)  quarantine 
D)  None of the above

Question 19

________ punishments may result in jail time.

Accepted Answer

A)  Criminal 
B)  Civil 
C)  Both A and B 
D)  Neither A nor B 
A)  Criminal 
B)  Civil 
C)  Both A and B 
D)  Neither A nor B

Question 20

________ are failures to report true attack activities.

Accepted Answer

A)  False positives 
B)  False negatives 
C)  Both A and B 
D)  Neither A nor B 
A)  False positives 
B)  False negatives 
C)  Both A and B 
D)  Neither A nor B

NIDs look at ________.

Incident response is defined as reacting to incidents according to plan.

HIDSs ________.

Repair during ongoing server operation is ________.

A walkthrough is also called a ________.

Which of the following is not one of the three levels of U.S. federal courts?

The prosecutor must demonstrate ________ at the time of the action at the center of a criminal trial.

A ________ is law dealing with information technology.

A ________ is a fake network segment with multiple clients and servers.

What information should alarms give the security staff?

The ________ collects event data and stores them in log files on the monitoring devices.

False positives are legitimate activities that are flagged as suspicious.

Plaintiffs initiate legal proceedings in ________ cases.

Total software reinstallation effectively addresses data loss.

Which of the following should the CSIRT include?

________ specify how a company will restore IT functions after a disaster.

Companies achieve time synchronization for integrated log files by using ________.

If an IDS cannot process all of the packets it receives, it will ________ packets it cannot process.

________ punishments may result in jail time.

________ are failures to report true attack activities.

The Threat Environment

Planning and Policy

Cryptography

Secure Networks

Access Control

Firewalls

Host Hardening

Application Security

Data Protection

Module A: Networking Concepts

Filters

Exam 10: Incident and Disaster Response

NIDs look at ________.

Incident response is defined as reacting to incidents according to plan.

HIDSs ________.

Repair during ongoing server operation is ________.

A walkthrough is also called a ________.

Which of the following is not one of the three levels of U.S. federal courts?

The prosecutor must demonstrate ________ at the time of the action at the center of a criminal trial.

A ________ is law dealing with information technology.

A ________ is a fake network segment with multiple clients and servers.

What information should alarms give the security staff?

The ________ collects event data and stores them in log files on the monitoring devices.

False positives are legitimate activities that are flagged as suspicious.

Plaintiffs initiate legal proceedings in ________ cases.

Total software reinstallation effectively addresses data loss.

Which of the following should the CSIRT include?

________ specify how a company will restore IT functions after a disaster.

Companies achieve time synchronization for integrated log files by using ________.

If an IDS cannot process all of the packets it receives, it will ________ packets it cannot process.

________ punishments may result in jail time.

________ are failures to report true attack activities.

The Threat Environment

Planning and Policy

Cryptography

Secure Networks

Access Control

Firewalls

Host Hardening

Application Security

Data Protection

Module A: Networking Concepts

Filters