Chapter 7- Security Operations Flashcards
Which of the following is the best response after detecting and verifying an incident?
A) Contain it
B) Report it
C) Remediate it
D) Gather evidence
A) Contain it
Which of the following would security personnel do during the remediation stage? A) Contain the incident B) Collect evidence C) Rebuild system D) Root Cause Analysis
D) Root cause analysis
Of the following choices, which of the following is the most common method of distributing malware? A) Drive-by-downloads B) USB flash drives C) Ransomware D) Unapproved software
A) Drive-by-downloads
What is the end goal of disaster recovery?
A) Preventing business interruptions
B) Setting up temporary business operations
C) Restoring normal business activity
D) Minimizing the impact of a disaster
C) Restore normal business activity
What does the term “100 year floor plain” mean to emergency preparedness officials”
A) The last flood of any kind to hit the area was more than 100 years ago.
B) The odds of a flood at this level are 1 in 100 in any given year
C) The area is expected to be safe from flooding for at least 100 years
D) The last significant flood to hit the area was more than 100 years ago.
B) The odds of a flood at this level are 1 in 100 in any given year.
Which one of the following trusted recovery types does not fail into a secure operating state? A) Manual recovery B) Automate Recovery C) Automated recovery without undue loss D) Function recovery
A) In a manual recovery approach, the system does not fail into a secure state but requires an administrator to manually restore operations. In an automated recovery, the system can recover itself against one or more failure types. In an automated recovery without undue loss, the system can recover itself against one or more failure types and also preserve data against loss. In function recovery, the system can restore functional processes automatically.
Scott would like to identify compromised systems on his network that may be participating in a botnet. He plans to do this by watching for connections made to known command and control servers. Which one of the following techniques would be most likely to provide this information if Jim has access to a list of known servers? A) Netflow records B) IDS logs C) Authentication logs D) RFC logs
A) Netflow records contain an entry for every network communication session that took place and can be compared to a list of known malicious hosts. IDS logs contain a relevant record, but it is less likely because they would only create log entries if the traffic triggers the IDS, opposed to netflow records, which encompass all communications. Authentication and RFC logs would not records of any network traffic.
Gary is preparing to develop controls around access to root encryption keys and would like to apply a principle of security designed specifically for very sensitive operations. Which principle should he apply? A) Least privilege B) Defense in depth C) Security through obscurity D) Two-person control
D) Gary should follow the principle of two-person control by requiring simultaneous action by two separate authorized individuals to gain access to the encryption keys. He should also apply the principles of least priv and defense in depth, but these principles apply to all operations are not specific to sensitive operations.
Which of the following terms is often used to describe a collection of unrelated patches released in a large collection? A) Hotfix B) Update C) Security fix D) Service pack
D) Hofixes, updates, and security fixes are all synonyms for single patches designed to correct a single problem. Service packs are collections of many different updates that serve as a major update to an operating system or application
Which one of the following tasks is performed by a forensic disk controller?
A) Masking error conditions reported by the storage device
B) Transmitting write commands to the storage device
C) Intercepting and modifying or discarding commands sent to the storage device
D) Preventing data from being returned by a read operation sent to the device.
C) Forensic disc controller performs four functions. One of those, write blocking, intercepts write commands sent to the device and prevents them from modifying data on the device. The other three functions include returning data requested by a read operation, returning access-significant information from the device, and reporting errors from the device back to the forensic host.
Which of the following would normally be considered an example of a disaster when performing disaster recovery planning?
1) Hacking incident
2) Flood
3) Fire
4) Terrorism
A) 2 and 3
B) 1 and 4
c) 2,3, and 4
d) All of the above
D) A disaster is any event that can disrupt normal IT operations and can be either natural or manmade. Hacking and terrorism are examples of manmade disasters, while flooding and fire are examples of natural disasters
Which one of the following is not an example of backup tape rotation scheme? A)Grandfather/Father/Son B) Meet in the middle C) Tower of Hanoi D) Six cartridge weekly
B) Grandfather/father/son, tower of hanoi, and six cartridge weekly schemes are all different approaches to rotating backup media that balance reuse of media with data retention concerns.
Meet in the middle is a crytographic attack against 2DES encryption
Which one of the following security tools is not capable of generating an active response to a security event? A) IPS B) Firewall C) IDS D) Antivirus software
C) Intrusion detection systems provide only passive responses, such as alerting admins to a suspected attack. Intrusion prevention systems and firewalls, on the other hand, may take action to block an attack attempt. Antivirus software also may engage in active response by quarantining suspect files.
What term is used to describe the default set of privileges assigned to a user when a new account is created? A) Aggregation B) Transitivity C) Baseline D) Entitlement
D) Entitlement refers to the privileges granted to users when an account is first provisioned
Florian is building a DR plan for his organization and would like to determine the amount of time that a particular IT service may be down without causing serious damage to business operations. What variable is Florian calculating A) RTO B) MTD C) RPO D) SLA
B) The maximum tolerable downtime (MTD) is the longest amount of time that an IT service or component may be unavailable without causing serious damages to the organization. The recovery time objective (RTO) is the amount of time expected to return an IT service or component to operation after a failure. The recovery point objective (RPO) identifies the maximum of dat, that may be lost during a recovery effort. Service level agreements are written contracts that document service expectation.
