Domain 2 Flashcards
- Q: What is the primary focus of Domain 2 in the CIA Triad?
A: Availability.
What is the role of an Incident Response Plan (IRP)?
To address unexpected changes and maintain operations.
What is the purpose of a Business Continuity Plan (BCP)?
To enable continued operations during crises.
When is a Disaster Recovery Plan (DRP) activated?
When Incident Response and Business Continuity plans fail.
Define a “breach.”
Unauthorized access or acquisition of information.
What is a “zero day”?
An unknown vulnerability with no detection or prevention methods.
What is the first priority of any incident response?
Protecting life, health, and safety.
What is the main goal of incident response preparation?
To reduce incident impact and resume operations swiftly.
Name a key component of a Business Continuity Plan.
Contact numbers for critical supply chain partners.
What is the Red Book in the context of Business Continuity?
A hard copy of the BCP kept outside the facility for use during outages.
Give an example of a Business Continuity scenario.
A billing department uses an alternate work area after a fire.
What is the primary goal of disaster recovery?
Restoring IT and communication systems to full operations.
What are the types of disaster recovery documentation?
Executive summaries, department-specific plans, and technical guides.
Define a Computer Incident Response Team (CIRT).
A team investigating and responding to security incidents.
What are the four main responsibilities of an incident response team?
Assess damage, identify compromised info, recover, and prevent recurrence.
What is the first step in activating a BCP?
Notify the appropriate individuals and begin plan execution.
How is communication maintained in critical infrastructures during disruptions?
Using military-grade networks assigned to authorized personnel.
What does a Business Impact Analysis (BIA) identify?
The dependencies and critical functions of a business.
Name a key activity during post-incident analysis.
Conducting a retrospective to identify lessons learned.
What does incident containment involve?
Gathering evidence, isolating the attack, and identifying the attacker.
How are disaster recovery backups maintained?
By ensuring multiple levels of backups and retention periods.
What should be included in the checklists for disaster recovery?
Steps for IT personnel to activate alternate sites.
What is an example of disaster recovery complexity?
Data flow between interdependent systems.
Why is training important for incident response team members?
To differentiate typical issues from security incidents.
