CJCSM 6510.01B, Encl. D Flashcards
What seeks to identify the root cause(s) of an incident and is required to fully understand the scope,
potential implications, and extent of damage resulting from the incident?
Incident Analysis
What is defined as the process of acquiring, preserving, and analyzing IS artifacts that help characterize
the incident and develop COA?
System Analysis
What is defined as the process of identifying, analyzing, and characterizing reported software artifacts
suspected of being adversarial tradecraft to help defense in depth mitigation actions and strategies, CI
activities, and LE activities?
Malware Analysis
What is considered the application of science to the identification, collection, examination, and analysis
of data while preserving the integrity of the information and maintaining a strict chain of custody?
Computer forensiscs
Which publication can guidance be found on integrating forensic techniques into incident response?
NIST SP 800-86
How many basic phases are in the forensics process?
4
Which type of data is stored in IS memory that will be lost when the IS loses power or is shut down?
Volatile
Which type of data is stored in the IS’s hard drives and removable storage media that will not be changed
when the IS is powered off?
Persistent
What is defined as software designed and/or deployed by adversaries without the consent or knowledge
of the user in support of adversarial missions?
Malware
Which type of analysis involves quick checks to characterize the malware sample within the context of
the analysis mission?
Surface
Which type of analysis is the controlled execution of the malware sample in an isolated environment to
monitor, observe, and record run-time behavior without impacting mission-critical systems and
infrastructure?
Run-time
Which type of analysis focuses on examining and interpreting the contents of the malware sample in the
context of an analysis mission?
Static
What is the most in-depth form of malware analysis?
Reverse engineering
What must any malware that is uncovered throughout the incident response process be cataloged to?
JMC
Network analysis comprises data sources, data collection, along with what else?
Data analysis
