Ch10 Dealing with Incidents Flashcards
the 7 steps of the Incident Response Process are: Preparation, ___, ___, Containment, ___, ___, Documentation
Reporting; Identification; Eradication; Recovery
the group of people whose job it is to respond to a cyber security incident is the ___
Cyber Incident Response Team (CIRT)
the plan for who to report an incident to depending on its severity is the ___
chain of escalation
the chain of custody process includes: ___, collection method, date/time collected, person collecting it, ___, and all locations of the evidence
defining the data; function/qualification of the person collecting the data
when retrieving system data as evidence, always use ___ software to demonstrate that you have not altered it
write block enabled
as you collect evidence, remember to ___ so you can be paid from the right people
track your hours
a __ recovery site might take a few days to bring online, it might have the equipment your need, but not the data
warm
the first item in the order of restoration after an incident is to verify ___
power is working on all outlets
a ___ is practicing the actual activities required to recover from an incident
failover
the Last Modified date/time of a file is known as its ___ for backup purposes
archive attribute
a ___ is a backup of all changes since the last Full backup
differential backup
an ___ is a backup of all changes since the last backup of any kind
Incremental
