Domain 7: Security Operations

Question 1

Evidence Types

Answer 1

• Real
• Demonstrative
• Documentary
• Testimonial

Question 2

Real Evidence

Answer 2

Objects and things a jury can physically hold and inspect.
- To be used at trial, real evidence must be relevant, material, and authentic.
- MUST establish the item’s chain of custody.

Question 3

Demonstrative Evidence

Answer 3

Usually charts and diagrams, to demonstrate or illustrate the testimony of a witness. It’s admissible when it fairly and accurately reflects the witness’s testimony and is more probative than prejudicial.

Question 4

Documentary Evidence

Answer 4

The production of documents at trial is documentary evidence.
- There are restrictions and qualifications for using documents at trial as there is a need to make sure they are authentic and trustworthy.

Question 5

Testimonial Evidence

Answer 5

It is simply a witness giving testimony under oath about the facts of the case.

Question 6

Requirements for Admissibility of Evidence

Answer 6

• Accuracy – lacking errors
• Authenticity - undisputed origin
• Comprehensibility – paint as much of the picture as possible
• Convincing – certainty in conclusions
• Objective – what the evidence says, not what you say
• Admissible – for the court in question

Question 7

Investigative Techniques

Answer 7

o Data capture – manual and automatic capture.
o Interviews – ideally from someone who was a witness to an incident or a person with first-hand knowledge of the incident.
o Interrogations – usually done by law enforcement following stringent rules.
o External requests – usually warrants and subpoenas.

Question 8

Write Blockers and Image Drivers

Answer 8

Designed to allow examination or imaging of a storage device, typically a hard drive, without writing any data to the storage device, which would violate the integrity of the evidence.

Question 9

Faraday Containers

Answer 9

Protects evidence from electromagnetic interference.

Question 10

Digital Forensic 6 Steps

Answer 10

1. Define priorities
2. Identify data sources
3. Plan to collect data and execute
4. Document and preserve integrity
5. Look for hidden or erased data
6. Perform analysis

Question 11

Recovery time objective (RTO)

Answer 11

The amount of time after an incident or disaster that passes before the system or process is recovered using contingency procedures.

Question 12

Recovery point objective (RPO)

Answer 12

The amount of data loss tolerable when a disaster occurs, usually expressed as a number of transactions or data points. RPO can also be expressed using time, like an RPO of no more than one day of data.

Question 13

Test-Driven Development (TDD)

Answer 13

First a test is written, then it is run. If it fails, code is written or refactored as needed to make the test succeed; the ultimate goal is to ensure that all tests pass.

Question 14

Maximum tolerable or allowable downtime (MTD or MAD)

Answer 14

The amount of time the organization can survive without an asset or process, after which the organization may no longer be viable. RTO should always be less than the MTD; otherwise, recovery is a moot point as the organization will cease to function before it occurs.

Question 15

3-2-1 Backup Strategy

Answer 15

At least three copies of data should be kept: two stored locally or onsite, including the main copy of the data, and one copy stored offsite.

Question 16

RAID (Redundant Array of Inexpensive Disk)

Answer 16

Pooling multiple disks, which may be cheaper than a single disk of equivalent size, to provide benefits of increased space, increased read/write speeds, data fault tolerance, or some combination of all three.

Question 17

RAID 0

Answer 17

Striped disk array with no fault tolerance; the primary benefit is increased read/write performance.

Question 18

RAID 1

Answer 18

Mirrored array that provides fault tolerance, but no read/write performance benefit.

Question 19

RAID 5

Answer 19

Striping with a parity array, which increases read/write performance and provides fault tolerance.

Question 20

RAID 0+1 and 1+0

Answer 20

Nested RAIDs that implement both functions of RAID 0 and 1 in different orders. 0+1 is a striped array of mirrors while 1+0 is a mirrored array of stripes. Both combine fault tolerance with increased performance.

Question 21

Recovery Cold Site

Answer 21

An empty facility that must be provisioned with equipment and utilities before being useful, which takes time and does not support a short RTO, but it also does not incur the high costs of duplicate infrastructure before an incident.

Question 22

Recovery Warm Site

Answer 22

Have some equipment but also require some buildout.

Question 23

Recovery Hot Site

Answer 23

The same infrastructure and data as the primary site, which is costly but useful for meeting a short RTO or RPO.

Question 24

Cloud Bursting Recovery

Answer 24

A relatively new recovery strategy that utilizes cloud services temporarily in the event of a disaster.

Question 25

Disaster Recovery Testing Methods (5)

Answer 25

• Read-through/Tabletop
• Walkthrough
• Simulation
• Parallel
• Full Interruption