15 D4 pt2

Question 1

Last step in Analyze phase is the ___; includes next actions necessary to respond.

Answer 1

Course of Action (COA)

Question 2

Firewalls:

___ - has 4 layers, provides additional security for servers.

Answer 2

Dual Firewall

Question 3

Incident handling and Response:

__- detection, analysis, and response to any event or incident.

Answer 3

Incident Handling

Question 4

__ Attacks can be malicious or non-malicious.

Answer 4

Insider

Question 5

Incident handling and Response:

__- compilation of incident or intrusion sets with similar characteristics..

Answer 5

Incident Sets

Question 6

Incident handling and Response:

__- occurrence having actual/potential adverse effects on an IS.

Answer 6

Incident

Question 7

A __ is a system or group of systems configured to enforce a security policy between 2 networks.

Answer 7

firewall

Question 8

Incident handling and Response:

__- an occurrence, not yet assessed that may affect performance of an IS.

Answer 8

Event

Question 9

Incident response categories:
Incidents:
\_\_ - root intrusion
\_\_ - user intrusion
\_\_ - DoS
\_\_ - Malicious logic

Answer 9

1 root intrusion
2 user intrusion
4 DoS
7 malicious logic

Question 10

Important principle of the Defense in Depth strategy is focused on these 3 elements:

Answer 10

People
Organizations
Technology

Question 11

Firewalls:

___ - simple and low cost, if router compromised the entire network is compromised.

Answer 11

Simple Firewall with 1 Choke

Question 12

For a firewall to be effective the following must be true:

• All traffic must be __
• Only __ __ is allowed to pass through
• the __/__ is highly resistant to penetration

Answer 12

• scanned
• authorized traffic
• system/host

Question 13

Firewalls:

___ - has 3 layers, if firewall is compromised additional protection exists.

Answer 13

Belt and Suspenders Architecture

Question 14

Firewall Types:

__ - checks packet header information, does not check packet contents.

Answer 14

Stateless packet filtering

Question 15

__, __, and __ are 3 tools that can carve files from the network.

Answer 15

Tcpxtract
Xplico
NetworkMiner

Question 16

Firewall Types:

__ - uses a combination of the other firewall techniques.

Answer 16

Hybrid

Question 17

Firewalls:

___ - Multiple NICs with one firewall for centralized security policies.

Answer 17

Multi-homed Firewall

Question 18

A combination of the below concepts represent the defense in depth model:

• __
• __
• __
• __

Answer 18

• deploy robust KMI/PKI
• deploy IDS to detect, evaluate, examine, and act on intrusions
• apply perimeter protection
• apply internal protection

Question 19

Incident handling and Response:

__- unauthorized access to an IS.

Answer 19

Intrusion

Question 20

Firewalls:

___ - has 2 layer, if the firewall is compromised the entire network is compromised.

Answer 20

Classic Firewall Architecture

Question 21

__- The intent of the methodology is to help coordinate, de-conflict, and execute an incident response within minutes or hours as opposed to days or weeks.

Answer 21

Incident Handling Methodology

Question 22

Firewall Types:
__ - examines both incoming and outgoing packets and has the ability to inspect communication layers and extract relevant data.

Answer 22

Stateful packet filtering

Question 23

Benefits of an IDS/IPS:
\_\_     \_\_
\_\_     \_\_
\_\_     \_\_
\_\_     \_\_
\_\_     \_\_
\_\_

Answer 23

Passive - Requires no modifications - Analyzes data as collected or after - Real time alert notifications - Data gathering upon detection - Replay computer transmissions - Full suite of analytic tools - Can command line or gui - Interface for secure connections - User customizable

Question 24

Firewall Types:
__ - listens for service requests from internal clients and forwards those requests to the external network; operates in application layer

Answer 24

Application layer gateway/proxy

Question 25

A __ is the technical and operational impact of the incident on the organization.

Answer 25

Battle Damage Assessment (BDA)

Question 26

Incident response categories:
Event:
\_\_ - unsuccessful access
\_\_ - non-compliance
\_\_ - reconnaissance
\_\_ - investigating
\_\_ - explained anomaly

Answer 26

3 unsuccessful access
5 non-compliance
6 reconnaissance
8 investigating
9 explained anomaly

Question 27

Incident and reportable event reporting follows 2 channels:
__ Channel - assists with incident handling and providing fixes.
__ Channel - designed to notify commanders.

Answer 27

Technical channel

Management channel

Question 28

__ hide private clients, can block dangerous urls, filter dangerous content, check the consistency of returned content, and lag behind new services.

Answer 28

Proxies