5B

Question 1

The primary goal of the __ ___ is to activate the CIRT and contain the incident.

Answer 1

First responder

Question 2

There are six steps taken in response to cyber incidents according to Air Force instruction _____, Cyber Incident Handling. Keep in mind that steps and terminology for the industry at large are slightly different than for the USAF.

Answer 2

AFI 17-203

Question 3

The six steps taken in response to cyber incidents are:

Answer 3

1. Detection and Reporting of Events
2. Preliminary Analysis and Identification
3. Preliminary Response Actions
4. Incident Analysis
5. Response and Recovery
6. Post-Incident Analysis

Question 4

The following describes which step in responding to a cyber incident?

• Intrusion Detection Systems (IDS) or personnel reports.
• Gather/report preliminary information.
• Begin coordinating reporting/response.

Answer 4

Detection and Reporting of Events

Question 5

The following describes which step in responding to a cyber incident?

• Categorize the activity (if upon initial analysis you cannot
  determine the cause, use Category 8: Investigating, and update as required).
• Gather additional info as required.
• Classify as required.
• Send notification messages per SOP’s

Answer 5

Preliminary Analysis and Identification

Question 6

The following describes which step in responding to a cyber incident?

• Contain incident/threat.
• Preserve data to allow for further incident analysis.
• Begin chain of custody docs.

Answer 6

Preliminary Response Actions

Question 7

The following describes which step in responding to a cyber incident?

• is the series of analytical steps taken to find out what occurred in an incident.
• Analyze data to understand technical details, root cause(s),
  and potential impact

Answer 7

Incident Analysis

Question 8

The following describes which step in responding to a cyber incident?

• Prevent further damage.
• Restore integrity of systems.
• Implement follow-up strategies

Answer 8

Response and Recovery

Question 9

The following describes which step in responding to a cyber incident?

• Review lessons learned.
• Root cause(s).
• Problems executing COAs.
• Missing policies/procedures.
• Inadequate infrastructure.

Answer 9

Post-Incident Analysis