Pre-Assessment Quiz Flashcards
The ____ illustrates the most critical characteristics of information and has been the industry standard for computer security since the development of the mainframe.
a. disaster recovery plan b. strategic plan c. asset classification d. C.I.A. triad
d. C.I.A. triad
The ____ is an investigation and assessment of the impact that various events or incidents can have on the organization.
a. cross-training analysis b. threat of attack analysis c. forensic analysis d. business impact analysis
d. business impact analysis
Check My Work
A resumption location known as a ____ is a fully configured computer facility capable of establishing operations at a moment’s notice.
a. hot site b. cold site c. mobile site d. service bureau
a. hot site
A(n) ____ is a detailed examination of the events that occurred, from first detection of an incident to final recovery.
a. after-action review b. reactive review c. audit review d. proactive review
a. after-action review
A CSIRT model in which a single CSIRT handles incidents throughout the organization is called a(n) ____.
a. employee-based CSIRT b. central CSIRT c. coordinating team d. organizational CSIRT
b. central CSIRT
Which of the following is not a “definite indicator” of an incident?
a. change to logs b. presence of hacker tools c. use of dormant access d. presence of unfamiliar files
d. presence of unfamiliar files
The ongoing activity from alarm events that are accurate and noteworthy but not necessarily as significant as potentially successful attacks is called ____.
a. noise b. tuning c. false positive d. confidence
a. noise
The process by which the CSIRT acts to limit the scale and scope of an incident and begins to regain control over the organization’s information assets is incident _____.
a. classification b. control c. containment d. recovery
c. containment
____ is used both for intrusion analysis and as part of evidence collection and analysis.
a. Digital forensics b. After-action reporting c. Loss analysis d. Configuration
a. Digital forensics
After the disaster has passed and its effects no longer directly impact the organization, the ____ phase begins.
a. actions-after b. blue bag operation c. chain of custody d. black bag operation
a. actions-after
