Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

IT Chief Exam 2018 > CJCSM 6510.01B Cyber Incident Handling Program > Flashcards

CJCSM 6510.01B Cyber Incident Handling Program Flashcards

1
Q

Federal agencies are required to have in place cyber incident handling mechanisms in accordance with which act?

A

FISMA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

How many services does the Department of Defense require Tier II Computer Network Defense Service Providers (CDSPs) to provide?

A

3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Which program was developed by the Department of Defense to provide specific guidance for CC/S/A/FAs regarding the requirements for cyber incident handling and reporting?

A

Cyber Incident Handling Program

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Joint Staff and CC/S/A/FAs will comply with DoD Cyber Incident Handling Program responsibilities in accordance with which reference?

A

CJCSI 6510.01

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Which agency must Joint Staff and CC/S/A/FAs ensure that Tier II CNDSPs are registered with to provide CND services for CC/S/A/FA information networks and ISs?

A

DISA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Which command must Joint Staff and CC/S/A/FAs coordinate with on cyber incidents prior to taking action outside the Department of Defense?

A

USCYBERCOM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Which command directs the operation and defense of DoD information networks IAW the UCP?

A

USSTRATCOM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What must USSTRATCOM coordinate with on matters relating to the governance, secure operations, and defense of the IC networks?

A

IC-IRC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What directs the actions taken, within the Department of Defense, to protect, monitor, analyze, detect, and respond to unauthorized activity within DoD information networks and ISs?

A

CND

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

How many different tiers is the Department of Defense organized into to conduct CND?

A

3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Which tier provides DoD-wide CND operational direction or support to CC/S/A/FAs?

A

Tier 1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Which tier provides DoD component-wide CND operational direction or support?

A

Tier 2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Which tier provides local CND operational direction or support?

A

Tier 3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Which type of data gives the Department of Defense the ability to sense changes in DoD information networks?

A

AS&W

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Which type of data gives the Department of Defense the ability to sense changes in adversary activities?

A

I&W

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Which community investigates criminal activity and disseminates threat data that may pertain to domestic or foreign individuals and groups who constitute threats to the Department of Defense?

A

LE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Which CND response service identifies several critical elements of an incident to determine and characterize its possible effects on DoD information networks, operational missions, and other defense programs?

A

Cyber Incident Analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What ensures the acquisition and preservation of data required for tactical analysis, strategic analysis, and/or LE investigations?

A

Cyber Incident Response

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is the DoD system of record for lessons learned?

A

JLLIS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is the primary vehicle for reporting and recording all cyber incidents and reportable events?

A

JIMS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Security classifications of cyber incidents are determined in accordance with which publication?

A

DoDI O-3600.02

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

How many different types of initial cyber incident reporting are there?

A

2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is the minimum security requirement when sending emails reporting a cyber incident?

A

digital signature

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What includes the coordinated and initial actions taken to protect the information network or IS from any further malicious activity and to acquire the data required for further analysis?

A

Preliminary response

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What will Cyber incident containment be coordinated with?

A

CNDSP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What type of data is RAM considered?

A

Volatile

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Which type of data are system images and malware considered to be?

A

Persistent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Which type of data is the configuration around the system considered to be?

A

Environmental

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is defined as a series of analytical steps taken to find out what happened in an incident?

A

Cyber incident analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What should any software artifacts suspected of being malware be submitted to?

A

Joint Malware Catalog (JMC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What is the primary path or method used by the adversary to cause the cyber incident or even to occur?

A

Delivery vector

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What expands upon the identified delivery vectors and system weaknesses by precisely identifying the sets of conditions allowing the incident to occur?

A

Root cause identification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What refers to a detrimental impact on an organization’s ability to perform its mission?

A

Operational Impact (OI)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What refers to an incident’s detrimental impact on the technical capabilities of the organization?

A

Technical Impact (TI)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What must actions that potentially affect traffic on the DoD Protected Traffic List be coordinated with?

A

USCYBERCOM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What involves understanding and accurately characterizing the relationship of incidents reported and providing awareness of the cyber security trends as observed by the affected parties?

A

Trending analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

ISs having which categories of cyber incidents must be rebuilt from trusted media and have up-to-date AV software loaded and configured IAW STIGs and WARNORDs prior to connecting the IS to the information network?

A

1, 2, and 7

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What is used to document the technical and operational impact of the cyber incident on the organization?

A

BDA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Within how many hours after the cyber incident has been resolved must the JIMS incident record be updated with the BDA?

A

24

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What are lessons learned, initial root cause, problems with executing COAs, and missing policies and procedures all part of?

A

Post-incident analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Where are cyber incidents sent that require a postmortem?

A

USCYBERCOM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What is defined as a set of scripts, programs, and other resources used to safely acquire, examine, and preserve volatile and non-volatile data from an IS?

A

First responder toolkit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

How many different types of incident response primary reporting structures are there?

A

2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Which type of reporting structure describes the interactions between each of the tier levels and how reporting, notification, and communications shall occur?

A

Technical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What are all reportable cyber events and incidents reported to?

A

USCYBERCOM

46
Q

What does USCYBERCOM receive reports from of all reportable cyber events and incidents?

A

JIMS

47
Q

What does USCYBERCOM disseminate information to about DoD Enterprise Incidents Sets?

A

STRATJIC

48
Q

What provides AS&W and a variety of technical alerts to USCYBERCOM that are shared with other tiers to direct response actions?

A

NTOC

49
Q

Who enters the cyber incident report into the JIMS?

A

CNDSP

50
Q

What serve as the focal points for reporting and handling cyber incidents and network management at the lowest level?

A

Network Service Centers (NSCs)

51
Q

What are issued by any unit commander to provide appropriate senior leadership immediate notification of an incident that has impacted or may impact the mission and/or operations?

A

OPREPs

52
Q

Which categories of cyber events or incidents affecting Mission Assurance Category (MAC) I or II ISs must be reported using OPREP-3 reporting procedures and structure?

A

1, 2, 4, and 7

53
Q

What does USCYBERCOM submit OPREP-3 for DoD-wide computer network incidents to?

A

USSTRATCOM

54
Q

Which categories of cyber events or incidents at a minimum are reported to DoD LE/CI IAW established CC/S/A/FA procedures?

A

1, 2, and 4

55
Q

What is the primary vehicle for reporting cyber incidents and reportable events?

A

JIMS

56
Q

What is the principal reporting vehicle for DoD SCI ISs?

A

JWICS

57
Q

What is defined as any information about an individual that is maintained by a DoD entity?

A

PII

58
Q

Reports of loss or suspected loss of PII must be submitted to the US-CERT within what time frame after the incident?

A

1 hour

59
Q

What is the classification of a cyber incident determined in accordance with?

A

DoDI O-3600.02

60
Q

What seeks to identify the root cause(s) of an incident and is required to fully understand the scope, potential implications, and extent of damage resulting from the incident?

A

Incident Analysis

61
Q

What is defined as the process of acquiring, preserving, and analyzing IS artifacts that help characterize the incident and develop COA?

A

System Analysis

62
Q

What is defined as the process of identifying , analyzing, and characterizing reported software artifacts suspected of being adversarial tradecraft to help defense in depth mitigation actions and strategies, CI activities, and LE activities?

A

Malware analysis

63
Q

What is considered the application of science to the identification, collection, examination, and analysis of data while preserving the integrity of the information and maintaining a strict chain of custody?

A

Computer forensics

64
Q

Which publication can guidance be found on integrating forensic techniques into incident response?

A

NIST SP 800-86

65
Q

How many basic phases are in the forensics process?

A

4

66
Q

Which type of data is stored in IS memory that will be lost when the IS loses power or is shutdown?

A

Volatile

67
Q

Which type of data is stored in the IS’s hard drives and removable storage media that will not be changed when the IS is powered off?

A

Persistent

68
Q

What is defined as software designed and/or deployed by adversaries without the consent or knowledge of the user in support of adversarial missions?

A

Malware

69
Q

Which type of analysis involves quick checks to characterize the malware sample within the context of the analysis mission?

A

Surface

70
Q

Which type of analysis is the controlled execution of the malware sample in an isolated environment to monitor, observe, and record run-time behavior without impacting mission-critical systems and infrastructure?

A

Run-time

71
Q

Which type of analysis focuses on examining and interrupting the contents of the malware sample in the context of an analysis mission?

A

Static

72
Q

What is the most in-depth form of malware analysis?

A

Reverse engineering

73
Q

What must any malware that is uncovered throughout the incident response process be cataloged to?

A

JMC

74
Q

Network analysis compromises data sources, data collection, along with what else?

A

Data analysis

75
Q

Which type of data can provide complete insight into the network transactions that occurred between hosts?

A

Full Packet Capture

76
Q

What is used to avoid allegations of mishandling or tampering with evidence and increases the probability of the evidence being entered into a court proceeding?

A

Chain of custody

77
Q

What is defined as an organized and coordinated series of steps to resolve or mitigate a reported incident?

A

Incident Response

78
Q

What have the primary objective to halt or minimize attack effects or damage while maintaining operational mission continuity?

A

Response Actions (RAs)

79
Q

How many different types of response activities can occur?

A

3

80
Q

Which type of RAs involve containment or eradication of any risks or threats associated with the cyber incident, and the rebuilding or restoring of affected ISs to a normal operational state?

A

Technical

81
Q

Which type of RAs require some type of administrative, supervisory, or management intervention, notification, interaction, escalation, or approval as part of any response?

A

Management

82
Q

What include the actions necessary to respond to the reportable cyber event or incident, fix the IS, return the IS to operations, and assess the risk for the IS or information network?

A

Courses of Action (COAs)

83
Q

Which command reserves the right to direct and assist CC/S/A/FAs with the response actions for incidents that fall into a DoD enterprise incident set or when actions otherwise affect multiple theater or Service information networks?

A

USCYBERCOM

84
Q

What is defined as short term, tactical actions to stop an intruder’s access to a compromised IS, limit the extent of an intrusion, and prevent an intruder from causing further damage?

A

Containment

85
Q

What is defined as using network access controls at the perimeter or enclave boundary to prevent the attacker from connecting to the other DoD information networks, ISs, or DoD data and services?

A

Blocking

86
Q

Which type of blocks are specific to the component behind the firewall?

A

Enclave

87
Q

What involves the use of network access controls to logically segment the network and restricted access to the affected hosts?

A

Network Isolation

88
Q

What is defined as the steps required to eliminate the root cause(s) of an intrusion?

A

Eradication

89
Q

Where must any malware that is uncovered throughout the incident response process be cataloged?

A

JMC

90
Q

What is defined as the steps necessary to restore the integrity of affected ISs, return the affected data, ISs, and information networks to an operational state, and implement follow up strategies to prevent the incident from happening again?

A

Recovery

91
Q

All ISs having which categories of incidents must be erased and rebuilt from trusted media, then patched and updated prior to connecting the IS to the information network?

A

1, 2, or 7

92
Q

What is defined as a review of the incident, including the detection, analysis, and response phases?

A

Postmortem

93
Q

What is the focal point for Net Defense threat data in the Department of Defense?

A

USCYBERCOM

94
Q

Which type of data consists of information that can help lead to increased defense of DoD information networks and the attribution of intent of network intruder(s)?

A

Threat

95
Q

What employs intelligence, counterintelligence, law enforcement and other military capabilities to defend DoD information and computer networks?

A

CND

96
Q

Where is the technical reporting between the incident handling program and intelligence maintained?

A

JIMS

97
Q

Which group consists of senior representatives from federal agencies that have roles and responsibilities related to preventing, investigating, defending against, responding to, mitigating, and assisting in the recovery from cyber incidents and attacks?

A

Cyber Unified Coordination Group (CUCG)

98
Q

What is an interagency forum where organizations responsible for a range of activities (technical response and recovery, LE, intelligence, and defensive measures) coordinate for the purpose of preparing for and executing an efficient and effective response to an incident?

A

NCRCG

99
Q

What is the central repository for managing all reportable events and incidents in the Department of Defense?

A

JIMS

100
Q

What is the system of record for the JLLP that provides a Web-enabled information management system to meet operational needs for reporting lessons learned?

A

Joint Lessons Learned Information System

JLLIS

101
Q

What is used by CND Analysts for collecting, processing, and storing the DoD networking sensing environment information, facilitating execution of selected COAs to mitigate and respond to attacks directed at DoD information networks?

A

Enterprise Sensor Grid (ESG)

102
Q

What is the functional owner of the JIMS and maintains and manages it?

A

USCYBERCOM

103
Q

What is the central repository for storing malware and associated analysis?

A

Joint Malware Catalog (JMC)

104
Q

What is the basis for the Department of Defense’s capability to rapidly analyze malicious code and provide an accurate understanding of its behavior and capabilities?

A

Joint Malware Catalog (JMC)

105
Q

What is the functional owner of the JMC?

A

USCYBERCOM

106
Q

What is the primary CND intelligence analysis tool suite used to derive CND intelligence information?

A

JIMS

107
Q

Which list ensures critical DoD ISs are not affected inadvertently by responses to CND events?

A

DoD Protected Traffic List

108
Q

What are defined as groups of related incidents and associated data requiring centralized management at the DoD level?

A

Incident sets

109
Q

How many progressive readiness conditions are there in the CYBERCON system?

A

5

110
Q

Operations in support of CYBERCON implementation will be executed in accordance with which publication?

A

CJCSI 3121.01B

IT Chief Exam 2018 (21 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions