IS3110 CHAP 15 Flashcards
A Web site used to hide a user’s activity on the Internet. The user visits the ___ site and then requests pages from other sites. The ___ retrieves the Web pages and serves them as if they are served from the ___ site.
Anonymizer
A formal process created by the organization to respond to computer incidents. It includes a definition of a computer incident.
CIRT plan
___ is any activity that threatens the security of the computer systems. It affects the organization’s security. It may result in loss of confidentiality, integrity, or availability.
computer incident
A group of people who will respond to incidents. This group can be a formal team designated in advance. It can also be an informal group created after an incident occurs.
Computer incident response team (CIRT)
A result of peer-to-peer (P2P) programs. P2P programs are commonly used to download pirated music, movies, and applications. Users are often unaware that the P2P programs also share data on their systems. ___ occurs when data on a user’s system is shared without the user’s knowing it.
Data leakage
Software that includes viruses, worms, Trojan horses, or any other type of malicious software.
Malware
- A(n) ___ is a violation of a security policy or security practice.
Computer incident or computer security incident
- All events on a system or network are considered computer security incidents.
TRUE OR FALSE
FALSE.
- An administrator has discovered that a Web server is responding very slowly. Investigation show that the processor, memory, and network resources are being consumed by outside attackers. This is a ___ attack.
Denial of service (DoS) or distributed DoS (DDoS)
- A user has installed P2P software on a system. The organization’s policy specifically states this is unauthorized. An administrator discovered the software on the user’s system. Is this a computer security incident? If so, what type?
- This is not a computer security incident
- This is a form of inappropriate usage
- This is a form of unauthorized access
- This is a form of malware
This is a form of inappropriate usage
- Some malware can execute on a user’s system after the user accesses a Web site. The malware executes
from within the Web browser. What type of malware is
this? - Virus
- Worm
- Trojan horse
- Mobile code
Mobile code
- A malicious virus is replicating and causing damage to computer. How do security professionals refer to the virus?
- In the open
- In the containment field
- In the jungle
- In the wild
In the wild
- What is the greatest risk to an organization when peer to peer software is installed on a user’s system?
- Loss of copyrights
- Piracy of the organization’s copyrighted material
- Data leakage
- DoS attacks
Data leakage
- Only police or other law enforcement personnel are allowed to do computer forensic investigations.
TRUE OR FALSE
FALSE
- A log has shown that a user has copied proprietary data to his computer. The organization wants to take legal action against the user. You are tasked with seizing the computer as evidence.
- Chain of command
- Forensic chain
- Permission from the user
- Chain of custody
- All the above
Chain of command
Forensic chain
Permission from the user
Chain of custody
- Many steps are taken before, during, and after an incident. Of the following choices, what accurately identifies the incident response life cycle?
- Preparation, deletion and analysis, eradication and recovery, and post-incident recover
- Detection and analysis, containment, backup and eradication, and post-incident recovery
- Preparation, detection and analysis, containment, eradication and recovery, and post-incident recovery
- Preparation, detection, deletion and analysis, containment and recovery, and post-incident recovery
Preparation, detection and analysis, containment, eradication and recovery, and post-incident recovery
- In general, it is acceptable for members of a CIRT to take actions to attack attackers. This is one of the normal responsibilities of a CIRT.
TRUE OR FALSE
FALSE
- After an incident has been verified, you need to ensure that it doesn’t spread to other systems. What is this called?
- Spread avoidance
- Containment
- Incident response
- Impact and priority calculation
Containment
- Which of the following may be included in a CIRT plan?
- Policies
- Definitions of incidents
- CIRT member responsibilities
- Incident handling procedures
- All the above
- 3 and 4 only
CIRT member responsibilities
Incident handling procedures
- Attackers attempt a DoS attack on servers in your organization. The CIRT respond and mitigates the attack. What should be the last step that the CIRT will complete in response to this incident?
- Attack the attacker
- Contain the threat
- Document the incident
- Report the incident
Document the incident
- Several types of malicious code exist. Malware that appears to be one thing but is actually something else is ___.
A Trojan Horse
