CJCSM 6510.01B, Encl. E Flashcards
What is defined as an organized and coordinated series of steps to resolve or mitigate a reported
incident?
Incident Response
What have the primary objective to halt or minimize attack effects or damage while maintaining
operational mission continuity?
Response Actions (RAs)
How many different types of response activities can occur?
3
Which type of RAs involve containment or eradication of any risks or threats associated with the cyber
incident, and the rebuilding or restoring of affected ISs to a normal operational state?
Technical
Which type of RAs require some type of administrative, supervisory, or management intervention,
notification, interaction, escalation, or approval as part of any response?
Management
What include the actions necessary to respond to the reportable cyber event or incident, fix the IS, return
the IS to operations, and assess the risk for the IS or information network?
Courses of Action (COAs)
Which command reserves the right to direct and assist CC/S/A/FAs with response actions for incidents
that fall into a DoD enterprise incident set or when actions otherwise affect multiple theater or Service
information networks?
USCYBERCOM
What is defined as short term, tactical actions to stop an intruder’s access to a compromised IS, limit the
extent of an intrusion, and prevent an intruder from causing further damage?
Containment
What is defined as using network access controls at the perimeter or enclave boundary to prevent the
attacker from connecting to other DoD information networks, ISs, or DoD data and services?
Blocking
Which type of blocks are specific to the component behind the firewall?
Enclave
What involves the use of network access controls to logically segment the network and restrict access to the affected hosts?
Network Isolation
What is defined as the steps required to eliminate the root cause(s) of an intrusion?
Eradication
Where must any malware that is uncovered throughout the incident response process be cataloged?
JMC
What is defined as the steps necessary to restore the integrity of affected ISs, return the affected data,
ISs, and information networks to an operational state, and implement follow up strategies to prevent the
incident from happening again?
Recovery
All ISs having which categories of incidents must be erased and rebuilt from trusted media, then
patched and updated prior to connecting the IS to the information network?
1, 2, or 7
