Domain 7 security operations COPY Flashcards
If we look at our Disaster Recovery Plan (DRP) for what to do when we are attacked, in which phase of incident management do we shut system access down?
A: Detection
B: Preparation
C: Response
D: Recovery
Explanation
D: Response
The response phase is when the incident response team begins interacting with affected systems and attempts to keep further damage from occurring as a result of the incident. This can be taking a system off the network, isolating traffic, powering off the system, or however our plan dictates to isolate the system to minimize both the scope and severity of the incident. Knowing how to respond, when to follow the policies and procedures to the letter and when not to, is why we have senior staff handle the responses. We make bit level copies of the systems, as close as possible to the time of incidence to ensure they are a true representation of the incident.
Which of the following is not true about continuous monitoring?
A. It involves ad hoc processes that provide agility in responding to novel attacks.
B. Its main goal is to support organizational risk management.
C. It helps determine whether security controls remain effective.
D. It relies on carefully chosen metrics and measurements.
the answer is A:
Continuous monitoring is a deliberate, data-driven process supporting organizational risk management. One of the key questions it answers is: are controls still effective at mitigating risks? Continuous monitoring could potentially lead to a decision to implement specific ad hoc processes, but these would not really be part of continuous monitoring.
which two numbers are required for DRBC
- sla, roi
- sle, aro
- rto, rpo
- itil, ale
rto and rpo (recovery time object and recovery point objective)
how many DRPs are part of BC
there could be many (no limit) DR plans under the business continuity plan
what is the goal of recovery
resumption of critical business functions
When we are doing our digital forensics, in which order would we perform the steps?
A: identify, acquire, analyze, report
B: identify, analyze, acquire, report
C: analyze, identify, acquire, report
D: report, identify, analyze, report
A: identify, acquire, analyze, report
Explanation
The digital (computer) forensics process: Identify the potential evidence, acquire the evidence, analyze the evidence, make a report. We need to be more aware of how we gather our forensic evidence, attackers are covering their tracks, deleting the evidence and logs.
As part of our Disaster Recovery Plan (DRP), we are building our secondary data center 100 miles (160 km.) from our primary data center.
With which of these secondary sites would we MOST LIKELY be back up and running on our critical applications within 3 hours?
(Select all that apply).
A: warm site
B: cold site
C: hot site
D: redundant site
C and D
Explanation
Redundant site: Complete identical site to our production site, receives a real time copy of our data. If our main site is down the redundant site will automatically have all traffic fail over to the redundant site. Hot site: Similar to the redundant site, but only houses critical applications and systems, often on lower spec’d systems. We may have to manually fail traffic over, but a full switch can take an hour or less. Warm sites would take 4-24+ hours, cold sites can take weeks.
What would we have our staff sign to acknowledge they understand and agree with their assigned responsibilities during a disaster?
A: MOU
B: MTT
C: MRA
D: MIT
A: MOU
Explanation
MOU/MOA (Memorandum of Understanding/Agreement): Our staff signs a legal document acknowledging they are responsible for a certain activity. If the test asks “A critical staff member didn’t show, and they were supposed to be there. What could have fixed that problem?” it would be the MOU/MOA. While slightly different they are used interchangeably on the test.
what does SOAR stand for
security orchestration, automation and response
Which of these is NOT protected by the 4th amendment in the US?
A: your internet history
B: anything search warranted
C: your emails
D: anything done online
B: anything search warranted
Explanation
We ensure our evidence is acquired in legal manner remember the US Constitution 4th amendment. The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated. Anything supinated, search warranted, turned over voluntary and in exigent circumstances (immediate danger of being destroyed), can allow law enforcement to bypass the 4th amendment.
what is BC focused on
- IT
- accounting
- operations
- continuity of the organization’s business operations
continuity of the organization’s business operations
As part of our Disaster Recovery Plan (DRP), we are building our secondary data center 100 miles (160 km.) from our primary data center.
With which of these secondary sites would we MOST LIKELY be back up and running on our critical applications within 3 hours?
(Select all that apply).
A: cold site
B: warm site
C: redundant site
D: hot site
Explanation – C and D
Redundant site: Complete identical site to our production site, receives a real time copy of our data. If our main site is down the redundant site will automatically have all traffic fail over to the redundant site. Hot site: Similar to the redundant site, but only houses critical applications and systems, often on lower spec’d systems. We may have to manually fail traffic over, but a full switch can take an hour or less. Warm sites would take 4-24+ hours, cold sites can take weeks.
As part of our disaster recovery response, we are paying a provider to keep a copy of our servers and data. The servers are to remain down always, with the exception of patches and database syncs, and are only to be spun up if we have a disaster. What would this be called?
A: redundant
B: mobile site
C: reciprocal
D: subscription site
D: subscription site
Explanation
Subscription/cloud site: We pay someone else to have a minimal or full replica of our production environment up and running within a certain number of hours (SLA). They have fully built systems with our applications and receive backups of our data, if we are completely down we contact them and they spin the systems up and apply the latest backups. How fast and how much is determined by our plans and how much we want to pay for this type of insurance.
what is recovery point object (RPO)
the amount of data loss tolerable when an incident or disaster occurs. usually expressed in number of transactions or data points. (how often are backups being done.
Jane is doing network forensics on an attack. Which of these is a COMMON form used?
A: catch-as-you-can
B: stop, act, prevent
C: catch-and-release
D: stop and release
A: catch-as-you-can
Explanation
Network forensics: Systems used to collect network data for forensics use usually come in two forms: Catch-it-as-you-can: All packets passing through a certain traffic point are captured and written to storage with analysis being done subsequently in batch mode. This approach requires large amounts of storage. Stop, look and listen: Each packet is analyzed in a basic way in memory and only certain information is saved for future analysis. This approach requires a faster processor to keep up with incoming traffic.
Our main facility has been hit with a complete power outage and we need to set up a temporary command and control center. What would we be deploying?
A: eoc
B: drp
C: coop
D: eoo
Explanation — A
EOC (Emergency Operations Center): A central temporary command and control facility responsible for our emergency management, or disaster management functions at a strategic level during an emergency. It ensuring the continuity of operation of our organization. We place the EOC in a secure location if the disaster is impacting a larger area.
