CIH Flashcards
preparation for CIH exam
A Distributed Denial-of-Service (DDoS) attack is a more common type of DoS attack, where a single system is targeted by a large number of infected machines over the Internet. In a DDoS attack, attackers first infect multiple systems which are known as:
Spyware
Zombies
Worms
Trojans
Zombies
Which one of the following is the correct flow of the stages in an incident response?
Eradication –> Containment –> Identification –> Preparation –> Recovery –> Follow-up
Identification –> Preparation –> Containment –> Recovery –> Follow-up - -> Eradication
Containment –> Identification –> Preparation –> Recovery –> Follow-up –> Eradication
Preparation –> Identification –> Containment –> Eradication –> Recovery –> Follow-up
Preparation –> Identification –> Containment –> Eradication –> Recovery –> Follow-up
Risk analysis involves the process of defining and evaluating dangers. The numerical determination of the probability of an adverse event, and the extent of the losses due to the event, refers to which approach of risk determination? Descriptive risk analysis Analytical risk analysis Quantitative risk analysis Qualitative risk analysis
Quantitative risk analysis
One of the main objectives of incident management is to prevent incidents and attacks by tightening the physical security of the system or infrastructure. According to CERT’s incident management process, which stage focuses on implementing infrastructure improvements resulting from postmortem reviews or other process improvement mechanisms? Detection Triage Protection Preparation
Protection
Insider threats can be detected by observing concerning behaviors exhibited by insiders, such as conflicts with supervisors and coworkers, decline in performance, tardiness, or unexplained absenteeism. Select the technique that helps in detecting insider threats.
Categorizing information according to its sensitivity and access rights
Protecting computer systems by implementing proper controls
Making it compulsory for employees to sign a nondisclosure agreement
Correlating known patterns of suspicious and malicious behavior
Correlating known patterns of suspicious and malicious behavior
Risk management consist of three processes; risk assessment, risk mitigation and evaluation and assessment. Risk assessment determines the extent of the potential threat and the risk associated with an IT system throughout its SDLC. How many primary steps does NIST’s risk assessment methodology involve? Nine Twelve Four Six
Nine
An incident response plan consists of a set of instructions to detect and respond to an incident. It defines the areas of responsibility, and creates procedures for handling various computer security incidents. Which of the following is an essential pre-requisite for an Incident response plan? Availability of forensic experts An approval from court of law Incident analysis report Company’s financial support
Company’s financial support
Incident handling and response steps help you to detect, identify, respond, and manage an incident. Which of the following helps in recognizing and separating the infected hosts from the information system?
Configuring firewall to default settings
Browsing particular government websites
Inspecting the processes running on the system
Sending mails to only group of friends
Inspecting the processes running on the system
Incident handling and response steps help you to detect, identify, respond and manage an incident. Which of the following steps focuses on limiting the scope and extent of an incident? Identification Data Collection Containment Eradication
Containment
In which of the steps of NIST’s risk assessment methodology are the boundaries of the IT system, along with the resources and the information that constitute the system, identified? Control Recommendations Control Analysis System Characterization Likelihood Determination
System Characterization
Which of the following incident recovery testing methods works by creating a mock disaster, like a fire, toidentify the reaction of the procedures that are implemented to handle such situations? Scenario testing Procedure testing Facility testing Live Walk Through testing
Scenario testing
US-CERT and federal civilian agencies use the reporting timeframe criteria in the federal agency reporting categorization. What is the timeframe required to report an incident under the CAT 4 federal agency category?
Weekly
Monthly
Within two (2) hours of discovery/detection
Within four (4) hours of discovery/detection if the successful attack is still ongoing and the agency is unable to successfully mitigate activity
Weekly
Identify the network security incident where intended authorized users are prevented from using system, network, or applications by flooding the network with a high volume of traffic that consumes all existing network resources. SQL injection URL manipulation XSS attack Denial-of-Service
Denial-of-Service
Multiple component incidents consist of a combination of two or more attacks in a system. Which of the following is not a multiple component incident?
An insider intentionally deleting files from a workstation
An attacker using email with malicious code to infect internal work station
An attacker redirecting user to a malicious website and infects his system with Trojan
An attacker infecting a machine to launch a DDoS attack
An insider intentionally deleting files from a workstation
The data on affected systems must be backed up so that it can be retrieved if it is damaged during incident response. The system backup can also be used for further investigation of the incident. Identify the stage of the incident response and handling process in which complete backup of the infected system is carried out? Containment Incident recording Incident investigation Eradication
Containment
An access control policy authorizes a group of users to perform a set of actions on a set of resources. Access to resources is based on necessity and if a particular job role requires the use of those resources. Which of the following is not a fundamental element of an access control policy?
Action group: Group of actions performed by the user on resources
Development group: Group of persons who develop the policy
Access group: Group of users to which the policy applies
Resource group: Resources controlled by the policy
Development group: Group of persons who develop the policy
Host based evidence is the evidence gathered and available on a computer system. It may include logs, records, documents, and any other information stored in a computer system. Network-based evidence is the information gathered from the network resources. Which of the following is Host-Based evidence? Wiretaps IDS logs Router logs State of network interface
State of network interface
Organizations, or incident response teams, need to protect the evidence for any future legal actions that may be taken against perpetrators that intentionally attacked the computer system. Evidence protection is also required to meet legal compliance issues. Which of the following documents helps in protecting evidence from physical or logical damage? Chain-of-Custody Chain-of-Precedence Forensic analysis report Network and Host log records
Chain-of-Custody
An organization faced an information security incident, where a disgruntled employee passed sensitive access control information to a competitor. The organization’s incident response manager, upon investigation, found that the incident must be handled within a few hours on the same day to maintain business continuity and market competitiveness. How would you categorize such information security incidents? High level incident Middle level incident Ultra-high level incident Low level incident
Middle level incident
Which among the following CERTs is an Internet provider to higher education institutions and various other research institutes in the Netherlands, and deals with all cases related to computer security incidents in which a customer is involved, either as a victim or as a suspect? Funet CERT SURFnet-CERT NET-CERT DFN-CERT
SURFnet-CERT
The goal of incident response is to handle the incidents in a way that minimizes damage and reduces recovery time and costs. Which of the following does not constitute a goal of incident response?
Dealing properly with legal issues that may arise during incidents
Using information gathered during incident handling to prepare for handling future incidents in a better way and to provide stronger protection for systems and data
Helping personnel to recover quickly and efficiently from security incidents, minimizing loss or theft of information and disruption of services
Dealing with human resource department and various employee conflict behaviors
Dealing with human resource department and various employee conflict behaviors
The insider’s incident response plan helps the organization to minimize or limit the damage caused due to malicious insiders. Organizations should ensure that the insider perpetrators are not included in the response team or are not aware of the progress. Which of the following statements is not true about the incident response plan?
The organization should regularly update the employee on different forms of external and internal attacks through training program
The employees should also be trained on how to report suspicious behaviors of the insiders
The organization should share or provide the details of the insider’s incident response plan with all employees
Persons responsible for handling insiders incidents should be trained on the contents and execution of the response plan
The organization should share or provide the details of the insider’s incident response plan with all employees
A computer virus hoax is a message warning the recipient of a non-existent computer virus threat. The message is usually a chain e-mail that tells the recipient to forward it to everyone they know. Which of the following is not a symptom of virus hoax message?
The message warns to delete certain files if the user does not take appropriate action
The message prompts the user to install Anti-virus
The message from a known email id is caught by SPAM filters due to change in filter settings
The message prompts the end user to forward it to his/her email contact list and gain monetary benefits in doing so
The message from a known email id is caught by SPAM filters due to change in filter settings
One of the goals of CSIRT is to manage security problems by taking a certain approach towards the customers’ security vulnerabilities, and by responding effectively to potential information security incidents. Identify the incident response approach that focuses on developing the infrastructure and security processes before the occurrence or detection of an event or any incident. Interactive approach Qualitative approach Proactive approach Interactive approach
Proactive approach
The type of relationship between CSIRT and its constituency have an impact on the services provided by the CSIRT. Identify the level of authority that enables the members of CSIRT to undertake any necessary actions on behalf of their constituency? Half-level authority Shared-level authority Mid-level authority Full-level authority
Full-level authority
Sam, an employee from a multinational company, uses his company’s account to send e-mails to a third party with their spoofed mail address. How can you categorize this type of account? Denial-of-Service incident Network intrusion incident Unauthorized access incident Inappropriate usage incident
Inappropriate usage incident
