5.4 Given a scenario, follow incident response procedures.

Question 1

Event

Answer 1

Defined as anything that happens during a set time period.

Question 2

Incident

Answer 2

Defined as an event that has a negative impact.

Question 3

Incident Response Plan (IRP)

Answer 3

A set of written instructions for reacting to a security incident.

Question 4

Cyber-incident Response Teams (CIRT)

Answer 4

A dedicated team that is responsible for the investigation of any computer security incidents that occur.

Question 5

Exercise

Answer 5

• Put simply, testing the IRP.
• Used to evaluate the preparedness of CIRT.
• A fire drill is an example of testing the IRP.

Question 6

Preparation

Answer 6

Equipping IT staff, management, and users to handle potential incidents when they arise.
Includes hardening systems in order to prevent and attack

Question 7

Identification

Answer 7

Determining whether an event is actually an incident.

Question 8

Containment

Answer 8

Limiting the damage of the incident and isolating those systems that are impacted and prevent the incident from spreading thus preventing further damage.

Quarantine/Isolation of the system to prevent spread.

Question 9

Eradication

Answer 9

Includes the processes used to remove or eliminate the cause of an incident.
(Wipe it out)

Question 10

Recovery

Answer 10

The process of removing and damaged elements from the environment and replacing them

Question 11

Lessons Learned

Answer 11

• The final step in the Incident Response Process.

* Perform an After Action Review of the incident and apply any required changes to the IRP and future responses

Question 12

In what phase of an incident response plan does the organization return to normal operations after handling a violating event?
A. Containment
B. Lessons Learned
C. Recovery
D. Eradication

Answer 12

C. Recovery

Question 13

Ben has been asked to work on a report that will analyze the results of an incident exercise with the purpose of identifying strengths to be maintained and weaknesses to be addressed for improvement. What report will he be working on?
A. Containment report
B. After Action Report
C. Identification of critical systems repor
D. Eradication Report

Answer 13

B. After Action Report

Question 14

It has been reported that someone has caused an information spillage incident on their computer. You go to the computer, disconnect it from the network, remove the keyboard and mouse, and power it down. What step in the incident response process did you just complete?
A. Identification
B. Isolation
C. Eradication
D. Containment

Answer 14

D. Containment