Quiz: Module 06

Question 1

The process of evaluating the circumstances around organizational events includes determining which adverse events are possible incidents, or ____.
a. critical violations
b. incident candidates
c. hacker intrusions
d. service alarms

Answer 1

b. incident candidates

Question 2

_____ is the process of gathering information about the organization and its network activities and the subsequent process of identifying network assets by a potential attacker.
a. fingerprinting
b. footholding
c. precursor estimating
d. footprinting

Answer 2

a. fingerprinting

Question 3

Which of the following is not a “possible indicator” of an incident?
a. presence of unfamiliar files
b. presence or execution of unknown programs or processes
c. presence of hacker tools
d. unusual consumption of computing resources

Answer 3

c. presence of hacker tools

Question 4

Most organizations will find themselves awash in incident candidates at one time or another, and the vast majority will be ____.
a. definite indicators
b. reported attacks
c. unusual system crashes
d. false positives

Answer 4

d. false positives

Question 5

Software designed to penetrate security controls, identify valuable content, and then encrypt files and data in place in order to extort payment for the key needed to unlock the encryption is known as _____.
a. ransomware
b. cryptojacking
c. pharming
d. data mining

Answer 5

a. ransomware

Question 6

The cyber kill chain involves evaluating the circumstances around organizational events and determining which adverse events are possible incidents.
a. True
b. False

Answer 6

b. False

Question 7

Many attacks come through network ports and then attack legitimate processes to allow themselves access or to conduct subsequent attacks.
a. True
b. False

Answer 7

a. True

Question 8

To help make the detection of actual incidents more reliable, there are three broad categories of incident indicators that have been identified: possible, probable, and definite.
a. True
b. False

Answer 8

a. True

Question 9

One of the more commonly seen and most easily avoided incidents is the denial-of-service attack.
a. True
b. False

Answer 9

b. False

Question 10

The detection of intrusions is a straightforward process easily performed by entry-level staff.
a. True
b. False

Answer 10

b. False