CJCSM 6510.01B, Encl. B Flashcards
What is the DoD system of record for lessons learned?
JLLIS
What is the primary vehicle for reporting and recording all cyber incidents and reportable events?
JIMS
Security classifications of cyber incidents are determined in accordance with which publication?
DoDI O-3600.02
How many different types of initial cyber incident reporting are there?
2
What is the minimum security requirement when sending e-mails reporting a cyber incident?
Digital Signature
What includes the coordinated and initial actions taken to protect the information network or IS from any further malicious activity and to acquire the data required fro further analysis?
Preliminary response
What will Cyber incident containment be coordinated with?
CNDSP
Which type of data is RAM considered?
Volatile
Which type of data are system images and malware considered to be?
Persistent
Which type of data is the configuration around the system considered to be?
Environmental
What is defined as a series of analytical steps taken to find out what happened in an incident?
Cyber incident analysis
What should any software artifacts suspected of being malware be submitted to?
Joint Malware Catalog (JMC)
What is the primary path or method used by the adversary to cause the cyber incident or even to occur?
Delivery vector
What expands upon the identified delivery vectors and system weaknesses by precisely identifying the
sets of conditions allowing the incident to occur?
Root cause identification
What refers to an incident’s detrimental impact on the technical capabilities of the organization?
Technical Impact (TI)
What refers to a detrimental impact on an organization’s ability to perform its mission?
Operational Impact (OI)
What must actions that potentially affect traffic on the DoD Protected Traffic List be coordinated with?
USCYBERCOM
What involves understanding and accurately characterizing the relationship of incidents reported and providing awareness of the cyber security trends as observed by the affected parties? (Page
Trending analysis
ISs having which categories of cyber incidents must be rebuilt from trusted media and have up-to-date
AV software loaded and configured IAW STIGs and WARNORDs prior to connecting the IS to the
information network?
1, 2, and 7
What is used to document the technical and operational impact of the cyber incident on the organization?
BDA
Within how many hours after the cyber incident has been resolved must the JIMS incident record be
updated with the BDA?
24
What are lessons learned, initial root cause, problems with executing COAs, and missing policies and
procedures all part of?
Post-incident analysis
Where are cyber incidents sent that require a postmortem?
USCYBERCOM
What is defined as a set of scripts, programs, and other resources used to safely acquire, examine, and
preserve volatile and non volatile data from an IS?
First responder toolkit
