IS4670 Chapter 13 Incident and Intrusion Response

Question 1

1. The ideal time for an organization to learn how to respond to security incidents is after suffering an attack.
   A. True
   B. False

Answer 1

FALSE

Question 2

2. It is impossible to prevent all security incidents. Therefore, when a security incident does occur, an organization must ________ its impact.

Answer 2

Minimize

Question 3

3. Which of the following is a violation of computer security policies, acceptable use policies, or standard security practices?
A. Event 
B. Adverse event 
C. Computer security incident 
D. US-CERT

Answer 3

Computer security incident

Question 4

4. The ideal incident response team membership and structure depends on the type of organization and its risk management strategy.
   A. True
   B. False

Answer 4

TRUE

Question 5

5. An incident response team should place all emergency system information in a central, offline location. Which of the following is not a type of information that falls into this category?
A. Malicious code 
B. Administrative passwords 
C. Network layout diagrams 
D. Router configuration information 
E. Firewall configuration information

Answer 5

Malicious code

Question 6

6. Which member of an incident response team is responsible for a particular incident or set of related security incidents?
A. Team leader 
B. Incident lead 
C. Associate member 
D. Chief information officer

Answer 6

Incident lead

Question 7

7. The incident response team performs most actions in response to an incident. However, all levels of IT staff should be aware of how to report incidents internally.
   A. True
   B. False

Answer 7

FALSE

Question 8

8. An organization’s ________ outlines specific procedures to follow in the event of a security incident.

Answer 8

Incident response plan

Question 9

9. An organization should try to let attackers know that the organization is aware of their activities.
   A. True
   B. False

Answer 9

FALSE

Question 10

10. ________ assists federal civilian agencies in their incident-handling efforts. It analyzes the information provided by all agencies to identify trends and precursors of attacks.

Answer 10

US-CERT

Question 11

11. When an organization is determining the damage it has sustained, it should consider both ________ and ________ costs.

Answer 11

Direct, Indirect