5.0 Recover

Question 1

Root cause analysis

Question 2

After- action report (AAR)

Question 3

Lessons learned

Question 4

Reporting and documentation

Question 5

Analyze incident reports

Question 6

Execute recovery planning processes and procedures

Question 7

Document and communicate results

Question 8

Security requirements of systems

Question 9

System interoperability and integration

Question 10

Actions

Question 11

Processes

Question 12

Tools and technologies

Question 13

Devices

Question 14

Systems

Question 15

Security features

Question 16

Management constraints

Question 17

Personnel security

Question 18

Physical structures, areas, and devices

Question 19

Memory forensics analysis/tools

Question 20

Volatility

Question 21

Data sources and disk images

Question 22

Analysis of digital evidence

Question 23

Analysis of digital evidence

Question 24

Hardware and software tools

Question 25

File copying techniques

Question 26

Logical backup

Question 27

Bit-streaming imaging

Question 28

File modification, access, and creation times

Question 29

Forensic recordkeeping

Question 30

Automated audit trails

Question 31

Chain of custody

Question 32

Forensic investigation

Question 33

Forensic collection and analysis tools

Question 34

Recovery planning processes

Question 35

Contingency planning

Question 36

Systems and assets

Question 37

Lessons learned

Question 38

Review of existing strategies

Question 39

Implement improvements

Question 40

Document and communicate reports, lessons learned, and advice for recovery, contingency, and continuity of operations plans