Incident Response and Recovery

Question 1

What is clock synchronization?

Answer 1

Prevents clock difference between client and server so that analysis of systems event logs are much easier

Question 2

What is eradication?

Answer 2

Finding and eliminating all copies of casual agents such as malware files or unauthorized user

Question 3

How you provide incident response support to forensics investigations?

Answer 3

Secure the scene, protect evidence, establish and maintain chain of custody of evidence

Question 4

What are the phases of incident response?

Answer 4

1. Detection
2. Characterization
3. Containment
4. Eradication
5. Restoration
6. Reporting

Preparation precedes first detection

Question 5

What kind of things might be an indicator of compromise?

Answer 5

Recognizable malware signatures, attempts to access IP addresses, or domain names associated with known or suspected botnet control server

Question 6

What is the main difference between WIPS and WIPS as compared with NIPS and NIDS?

Answer 6

Wireless detection and prevention needs to extend further into Layer 1 and 2 traffic and may also involve RF surveillance and mapping to identify interference, jamming, or rogue devices.

Wired do not go into Layer 1 or 2