Practice Questions Flashcards
Risk is defined as the probability of the occurrence of an incident. Risk formulation generally begins with the likeliness of an event’s occurrence, the harm it may cause, and is usually denoted as:
Significances
Probability
Magnitudes
Consequences
Consequences
Which of the following refers to the process of identifying, labeling, recording, and acquiring data from all possible sources?
a. Collection
b. Preservation
c. Examination
d. Analysis
Collection
Which among the following incidents refer to a person gaining access to system and network resources which he/she was not authorized to have?
a. Handling Inappropriate Usage Incidents
b. Unauthorized Access Incident
c. Handling Multiple Component Incidents
d. Authorized Access Incident
Unauthorized Access Incident
What is the purpose of proactive services offered by a CERT?
a. To find the cost of fixing a problem
b. To develop the infrastructure and security processes
c. To provide services to the constituency
d. None of the above
To develop the infrastructure and security processes
Which one of the following CSIRT services include alerts and warnings, incident handling, vulnerability handling, and artifact handling activities?
a. Reactive Services
b. Proactive Services
c. Security Quality Management Services
d. Vulnerability Management Services
Reactive Services
Which of the following is defined as the existence of a weakness in the design or implementation error that can lead to an unexpected, undesirable event compromising the security of the system?
a. Vulnerability
b. Patch
c. Attack
d. Accident
Vulnerability
Which one of the following is the intangible cost for an incident?
a. Lost productivity hours
b. Investigation and recovery efforts
c. Loss of business
d. Loss of reputation
Loss of reputation
Which of the following document contains logs, records, documents, and any other information that is found on a system?
a. Incident preparation report
b. Incident response report
c. Host-based evidence report
d. Network-based evidence report
Host-based evidence report
Which among the following malware pretends to be a program that offers useful applications, but acquires the information of the computer and sends it to a remote attacker?
a. Spyware
b. Worm
c. Virus
d. Rootkit
Spyware
Rob, an incident manager, was informed about an incident where a suspicious application was found residing in the active memory of multiple systems on a network. Upon investigation, he found that the application was self-replicating and degrading the systems’ performance, but it did not affect the files in those systems.
What is your inference from the above scenario?
a. The application is a Worm
b. The application is a Virus
c. The application is a Trojan
d. The application is a Backdoor
The application is a Worm
Identify the malicious program that is masked as a genuine harmless program, and gives the attacker unrestricted access to the user’s information and system. These programs may unleash dangerous programs that may erase the unsuspecting user’s disk, and send the victim’s credit card numbers and passwords to a stranger.
Cookie tracker
Worm
Virus
Trojan
Trojan
Which policy recommends controls for securing and tracking organizational resources?
Access control policy
Administrative security policy
Acceptable use policy
Asset control policy
Asset control policy
Which of the following terms may be defined as “a measure of possible inability to achieve a goal, objective, or target within a defined security, cost, plan, and technical limitations that adversely affects the organization’s operations and revenues?”
Incident Response
Threat
Vulnerability
Risk
Risk
The goal of incident response is to handle the incidents in a way that minimizes damage and reduces recovery time and costs. Which of the following does not constitute a goal of incident response?
Dealing properly with legal issues that may arise during incidents
Using information gathered during incident handling to prepare for handling future incidents in a better way and to provide stronger protection for systems and data
Helping personnel to recover quickly and efficiently from security incidents, minimizing loss or theft of information and disruption of services
Dealing with human resource department and various employee conflict behaviors
Dealing with human resource department and various employee conflict behaviors
Organizations, or incident response teams, need to protect the evidence for any future legal actions that may be taken against perpetrators that intentionally attacked the computer system. Evidence protection is also required to meet legal compliance issues. Which of the following documents helps in protecting evidence from physical or logical damage?
Chain-of-Custody
Chain-of-Precedence
Forensic analysis report
Network and Host log records
Chain-of-Custody
An audit trail policy collects all audit trails such as series of records of computer events, about an operating system, an application, or user activities. Which of the following statements is not true for an audit trail policy?
It helps in reconstructing the events after a problem has occurred
It helps in calculating intangible losses to the organization due to an incident
It helps in compliance to various regulatory laws, rules, and guidelines
It helps in tracking individual actions and allows users to be personally accountable for their actions
It helps in calculating intangible losses to the organization due to an incident
Which of the following risk mitigation strategy make an organization absorb minor risks while preparing to respond to major ones?
a. Risk avoidance
b. Risk limitation
c. Risk assumption
d. Risk planning
Risk assumption
Which among the following CERTs is an Internet provider to higher education institutions and various other research institutes in the Netherlands, and deals with all cases related to computer security incidents in which a customer is involved, either as a victim or as a suspect?
Funet CERT
SURFnet-CERT
NET-CERT
DFN-CERT
SURFnet-CERT
Which of the following is defined as an organized approach to address and manage the aftermath of a security breach or attack?
a. Threat
b. Risk Assessment
c. Vulnerability assessment
d. Incident response
Incident response
Which of the following is an indication of unauthorized usage of the standard user account?
a. Usage of secret account
b. Alert of network and host IDS
c. Misplaced hardware parts
d. Increase in the usage of resource
Usage of secret account
A file or an object found on the system that might involve attacking systems and networks is known as an “artifact”. Handling an artifact involves receiving information about the artifacts that are used in intruder attacks, investigation, and other unauthorized activities causing distortions. Identify the CSIRT service category that artifact handling belongs to?
Reactive services
Proactive services
Incident tracking and reporting systems services
Security quality management services
Reactive services
Which of the following is a process that ensures systems and major applications adhere to formal and established security requirements that are well documented and authorized?
a. Penetration testing
b. Computer forensics
c. Certification and Accreditation (C&A)
d. Incident handling
Certification and Accreditation (C&A)
Mysoft, a major software developer located out of New Jersey, realized that sensitive information from folders shared across its network is being accessed by unauthorized people and leaked to third parties, which could result in huge financial losses for the organization. In this context, which of the following statements most appropriately defines “computer security incident”?
Events related to physical security incidents and trouble- shooting issues in corporate networks
Any real or suspected adverse event in relation to the security of computer systems or networks
Policies guaranteeing access to information system resources
Rectifying the loss of information that may affect the investment of the organization in different business activities
Any real or suspected adverse event in relation to the security of computer systems or networks
A Distributed Denial-of-Service (DDoS) attack is a more common type of DoS attack, where a single system is targeted by a large number of infected machines over the Internet. In a DDoS attack, attackers first infect multiple systems which are known as:
a. Spyware
b. Zombies
c. Worms
d. Trojans
Zombies
Signs of an Incident are categorized into one of two categories: Precursor or Indication. Precursor indicates the possibility of a security incident occurrence, and Indication implies that an incident has probably occurred or is in progress. Identify which of the following is a precursor to an incident?
The network administrator notices an unusual deviation from the typical network traffic flows
A user approaches the help desk to report of abusing/threatening email
Warning from an antivirus program or scanner that threat(s) from virus/worm is identified on the user’s system.
A new found vulnerability in the organization server, in case the vendor makes an announcement of the same
A new found vulnerability in the organization server, in case the vendor makes an announcement of the same
The type of relationship between CSIRT and its constituency have an impact on the services provided by the CSIRT. Identify the level of authority that enables the members of CSIRT to undertake any necessary actions on behalf of their constituency?
Half-level authority
Shared-level authority
Mid-level authority
Full-level authority
Full-level authority
Which policy recommends controls for securing and tracking organizational resources?
Administrative security policy
Access control policy
Asset control policy
Acceptable use policy
Asset control policy
How will you define quantitative risk analysis?
a. Probability of loss x value of loss
b. Value of loss/Probability of loss
c. Probability of loss + value of loss
d. Probability of loss - value of loss
Probability of loss x value of loss
An access control policy authorizes a group of users to perform a set of actions on a set of resources. Access to resources is based on necessity and if a particular job role requires the use of those resources. Which of the following is not a fundamental element of an access control policy?
Action group: Group of actions performed by the user on resources
Development group: Group of persons who develop the policy
Access group: Group of users to which the policy applies
Resource group: Resources controlled by the policy
Development group: Group of persons who develop the policy
Except for some common roles, the roles in an IRT are distinct for every organization. Which among the following is the role played by the Incident Coordinator of an IRT?
Links the appropriate technology to the incident to ensure that the foundation’s offices are returned to normal operations as quickly as possible
Links the groups that are affected by the incidents, such as legal, human resources, different business areas, and management
Applies the appropriate technology and tries to eradicate and recover from the incident
Focuses on the incident and handles it from management and technical point of view
Links the groups that are affected by the incidents, such as legal, human resources, different business areas, and management
One of the goals of CSIRT is to manage security problems by taking a certain approach towards the customers’ security vulnerabilities, and by responding effectively to potential information security incidents. Identify the incident response approach that focuses on developing the infrastructure and security processes before the occurrence or detection of an event or any incident.
Interactive approach
Qualitative approach
Proactive approach
Interactive approach
Proactive approach
An incident is analyzed for its nature, intensity, and its effects on the network and systems. Which stage of the incident response and handling process involves auditing the system and network log files?
Identification
Containment
Incident recording
Reporting
Identification
US-CERT and federal civilian agencies use the reporting timeframe criteria in the federal agency reporting categorization. What is the timeframe required to report an incident under the CAT 4 federal agency category?
a. Weekly
b. Monthly
c. Within two (2) hours of discovery/detection
d. Within four (4) hours of discovery/detection if the successful attack is still ongoing and the agency is unable to successfully mitigate activity
Weekly
Which one of the following is an appropriate flow of steps in computer forensics process?
a. Preparation -> Collection -> Examination -> Analysis -> Reporting
b. Examination -> Analysis -> Preparation -> Collection -> Reporting
c. Analysis -> Preparation -> Collection -> Reporting -> Examination
d. Preparation -> Analysis -> Collection -> Examination -> Reporting
Preparation -> Collection -> Examination -> Analysis -> Reporting
Identify the network security incident where intended authorized users are prevented from using system, network, or applications by flooding the network with a high volume of traffic that consumes all existing network resources.
SQL injection URL manipulation XSS attack Denial-of-Service
Denial-of-Service
The data on affected systems must be backed up so that it can be retrieved if it is damaged during incident response. The system backup can also be used for further investigation of the incident. Identify the stage of the incident response and handling process in which complete backup of the infected system is carried out?
Containment
Incident recording
Incident investigation
Eradication
Containment
Hexagon, a leading IT company in the USA, have received a lot of malformed TCP/IP packets, which lead the main server’s operating system to crash and thereby restricted the employees from accessing their resources. Which attack did the adversary use in the above situation?
a. DoS attack
b. Session Hijacking
c. Man-in-the-Middle
d. Cross-Site-Scripting
DoS attack
Which of the following determines the level of risk and the resulting security requirements for each system?
a. Risk assessment
b. Contingency planning
c. Risk mitigation
d. Residual risk
Risk assessment
Which one of the following is the correct flow of the stages in an incident response?
a. Eradication –> Containment –> Identification –> Preparation –> Recovery –> Follow-up
b. Identification –> Preparation –> Containment –> Recovery –> Follow-up - -> Eradication
c. Containment –> Identification –> Preparation –> Recovery –> Follow-up –> Eradication
d. Preparation –> Identification –> Containment –> Eradication –> Recovery –> Follow-up
Preparation –> Identification –> Containment –> Eradication –> Recovery –> Follow-up
Information gathering is an integral part of information warfare. Which of the following activities is a part of passive information gathering?
Obtaining details of the target organization by scanning their network
Obtaining details of the target organization by taking services of underground hacking forums
Obtaining details of the target organization that are freely available on the Internet, and through various other techniques without coming into direct contact with the organization
Obtaining details of the target organization that are freely available on the Internet, and through various other techniques by coming into direct contact with the organization
Obtaining details of the target organization that are freely available on the Internet, and through various other techniques without coming into direct contact with the organization
An information system processes data into useful information to achieve specified organizational or individual goals. It accepts, processes, and stores data in the form of records in a computer system, and automates some of the information processing activities of the organization. Who is responsible for implementing and controlling the security measures of an information system?
Information Custodian
Information Owner
Information Implementer
Information Consultant
Information Custodian
A computer forensic investigator must perform a proper investigation to protect digital evidence. During the investigation, an investigator needs to process large amounts of data using a combination of automated and manual methods. Identify the computer forensic process involved.
Preparation
Collection
Reporting
Examination
Examination
The network perimeter should be configured in such a way that it denies all incoming and outgoing traffic/services that are not required. Which service listed below, if blocked, can help in preventing Denial of Service attack?
SMTP service
SAM service
POP3 service
Echo service
Echo service
In the DoS containment strategy, at what point you will ask your ISP to implement filtering?
a. After correcting the vulnerability or weakness that is being exploited
b. After relocating the affected target
c. After determining the method of attack
d. After identifying the attackers
After determining the method of attack
In which of the steps of NIST’s risk assessment methodology are the boundaries of the IT system, along with the resources and the information that constitute the system, identified?
a. Control Recommendations
b. Control Analysis
c. System Characterization
d. Likelihood Determination
System Characterization
Which one of the following is an appropriate flow of the incident recovery steps?
System Restoration –> System Validation –> System Operations –> System Monitoring
System Validation –> System Operations –> System Restoration –> System Monitoring
System Operations –> System Restoration –> System Validation –> System Monitoring
System Restoration –> System Monitoring –> System Validation –> System Operations
System Restoration –> System Validation –> System Operations –> System Monitoring
