Question 1

________ investigate(s) most violations of local and state computer laws.

Accepted Answer

A)  Local police 
B)  The FBI 
C)  Both A and B 
D)  Neither A nor B 
A)  Local police 
B)  The FBI 
C)  Both A and B 
D)  Neither A nor B

Question 2

It is easier to punish employees than to prosecute outside attackers.

Accepted Answer

A) True 
 B)False

Question 3

Mens Rea usually is important is ________ trials.

Accepted Answer

A)  civil 
B)  criminal 
C)  Both A and B 
D)  Neither A nor B 
A)  civil 
B)  criminal 
C)  Both A and B 
D)  Neither A nor B

Question 4

Wal-Mart was able to respond to hurricane Katrina so quickly because it had ________.

Accepted Answer

A)  detailed business continuity plans 
B)  a full-time director of business continuity 
C)  Both A and B 
D)  Neither A nor B 
A)  detailed business continuity plans 
B)  a full-time director of business continuity 
C)  Both A and B 
D)  Neither A nor B

Question 5

Federal jurisdiction typically does not extend to computer crimes that are committed entirely within a state and that do not have a bearing on interstate commerce.

Accepted Answer

A) True 
 B)False

Question 6

The analysis of multi-event patterns is called ________.

Accepted Answer

A)  event correlation 
B)  aggregation 
C)  filtering 
D)  All of the above 
A)  event correlation 
B)  aggregation 
C)  filtering 
D)  All of the above

Question 7

18 U.S.C. § 1030 prohibits hacking.

Accepted Answer

A) True 
 B)False

Question 8

Allowing an attacker to continue working in a system after the attack has been discovered ________.

Accepted Answer

A)  may allow the company to collect evidence for prosecution 
B)  can be dangerous by allowing the attacker to do more damage 
C)  Both A and B 
D)  Neither A nor B 
A)  may allow the company to collect evidence for prosecution 
B)  can be dangerous by allowing the attacker to do more damage 
C)  Both A and B 
D)  Neither A nor B

Question 9

Having a permanent business continuity staff is necessary.

Accepted Answer

A) True 
 B)False

Question 10

Courts will often admit unreliable evidence if judges believe that juries can be trusted to evaluate it properly.

Accepted Answer

A) True 
 B)False

Question 11

Interactive log file analysis can filter out irrelevant entries.

Accepted Answer

A) True 
 B)False

Question 12

________ deals with the violation of criminal statutes.

Accepted Answer

A)  Criminal law 
B)  Civil law 
C)  Both A and B 
D)  Neither A nor B 
A)  Criminal law 
B)  Civil law 
C)  Both A and B 
D)  Neither A nor B

Question 13

With CDP, the backup site already has the proper equipment, and data and recovery is instantaneous.

Accepted Answer

A) True 
 B)False

Question 14

18 U.S.C. § 1030 prohibits ________.

Accepted Answer

A)  hacking 
B)  malware attacks 
C)  denial-of-service attacks 
D)  All of the above 
A)  hacking 
B)  malware attacks 
C)  denial-of-service attacks 
D)  All of the above

Question 15

With good planning and protection, a company can eliminate security incidents.

Accepted Answer

A) True 
 B)False

Question 16

A ________ IDS sends data from many devices at a central management console.

Accepted Answer

A)  centralized 
B)  distributed 
C)  fragmented 
D)  decentralized 
A)  centralized 
B)  distributed 
C)  fragmented 
D)  decentralized

Question 17

In ________ transfers, each event's data goes to the manager immediately.

Accepted Answer

A)  batch 
B)  real-time 
C)  Both A and B 
D)  Neither A nor B 
A)  batch 
B)  real-time 
C)  Both A and B 
D)  Neither A nor B

Question 18

________ allows a response team to determine an incident's damage potential and to gather information needed to begin containment and recovery.

Accepted Answer

A)  Detection 
B)  Analysis 
C)  Both A and B 
D)  Neither A nor B 
A)  Detection 
B)  Analysis 
C)  Both A and B 
D)  Neither A nor B

Question 19

________ deals with interpretations of rights and duties that companies or individuals have relative to each other.

Accepted Answer

A)  Criminal law 
B)  Civil law 
C)  Both A and B 
D)  Neither A nor B 
A)  Criminal law 
B)  Civil law 
C)  Both A and B 
D)  Neither A nor B

Question 20

A CSIRT should include members from the public relations department.

Accepted Answer

A) True 
 B)False

________ investigate(s) most violations of local and state computer laws.

It is easier to punish employees than to prosecute outside attackers.

Mens Rea usually is important is ________ trials.

Wal-Mart was able to respond to hurricane Katrina so quickly because it had ________.

Federal jurisdiction typically does not extend to computer crimes that are committed entirely within a state and that do not have a bearing on interstate commerce.

The analysis of multi-event patterns is called ________.

18 U.S.C. § 1030 prohibits hacking.

Allowing an attacker to continue working in a system after the attack has been discovered ________.

Having a permanent business continuity staff is necessary.

Courts will often admit unreliable evidence if judges believe that juries can be trusted to evaluate it properly.

Interactive log file analysis can filter out irrelevant entries.

________ deals with the violation of criminal statutes.

With CDP, the backup site already has the proper equipment, and data and recovery is instantaneous.

18 U.S.C. § 1030 prohibits ________.

With good planning and protection, a company can eliminate security incidents.

A ________ IDS sends data from many devices at a central management console.

In ________ transfers, each event's data goes to the manager immediately.

________ allows a response team to determine an incident's damage potential and to gather information needed to begin containment and recovery.

________ deals with interpretations of rights and duties that companies or individuals have relative to each other.

A CSIRT should include members from the public relations department.

The Threat Environment

Planning and Policy

Cryptography

Secure Networks

Access Control

Firewalls

Host Hardening

Application Security

Data Protection

Module A: Networking Concepts

Filters

Exam 10: Incident and Disaster Response

________ investigate(s) most violations of local and state computer laws.

It is easier to punish employees than to prosecute outside attackers.

Mens Rea usually is important is ________ trials.

Wal-Mart was able to respond to hurricane Katrina so quickly because it had ________.

Federal jurisdiction typically does not extend to computer crimes that are committed entirely within a state and that do not have a bearing on interstate commerce.

The analysis of multi-event patterns is called ________.

18 U.S.C. § 1030 prohibits hacking.

Allowing an attacker to continue working in a system after the attack has been discovered ________.

Having a permanent business continuity staff is necessary.

Courts will often admit unreliable evidence if judges believe that juries can be trusted to evaluate it properly.

Interactive log file analysis can filter out irrelevant entries.

________ deals with the violation of criminal statutes.

With CDP, the backup site already has the proper equipment, and data and recovery is instantaneous.

18 U.S.C. § 1030 prohibits ________.

With good planning and protection, a company can eliminate security incidents.

A ________ IDS sends data from many devices at a central management console.

In ________ transfers, each event's data goes to the manager immediately.

________ allows a response team to determine an incident's damage potential and to gather information needed to begin containment and recovery.

________ deals with interpretations of rights and duties that companies or individuals have relative to each other.

A CSIRT should include members from the public relations department.

The Threat Environment

Planning and Policy

Cryptography

Secure Networks

Access Control

Firewalls

Host Hardening

Application Security

Data Protection

Module A: Networking Concepts

Filters