CIS 359 Midterm Exam Set 1 NEW

A CSIRT model that is effective for large organizations and for organizations with major computing resources at distant locations is the ____.

Question 2

The first group to communicate the CSIRT’s vision and operational plan is the managerial team or individual serving as the ____.

Question 3

Those services performed in response to a request or a defined event such as a help desk alert are called ____.

Question 4

One way to build and maintain staff skills is to develop incident-handling ____ and have the team members discuss how they would handle them.

Question 5

Giving the IR team the responsibility for ____ is generally not recommended.

Question 6

When an organization completely outsources its IR work, typically to an on-site contractor, it is called a(n) ____ model.

Question 7

The focus during a(n) ____ is on learning what worked, what didn’t, and where communications and response procedures may have failed.

Question 8

Those services undertaken to prepare the organization or the CSIRT constituents to protect and secure systems in anticipation of problems, attacks, or other events are called ____.

Question 9

____ are closely monitored network decoys serving that can distract adversaries from more valuable machines on a network; can provide early warning about new attack and exploitation trends; and can allow in-depth examination of adversaries during and after exploitation.

Question 10

Using a process known as ____, network-based IDPSs look for attack patterns by comparing measured activity to known signatures in their knowledge base to determine whether or not an attack has occurred or may be under way.

Question 11

In an attack known as ____, valid protocol packets exploit poorly configured DNS servers to inject false information to corrupt the servers’ answers to routine DNS queries from other systems on that network.

Question 12

The use of IDPS sensors and analysis systems can be quite complex. One very common approach is to use an open source software program called ____ running on an open source UNIX or Linux system that can be managed and queried from a desktop computer using a client interface.

Question 13

The ____ approach for detecting intrusions is based on the frequency with which certain network activities take place.

Question 14

A(n) ____ , a type of IDPS that is similar to the NIDPS, reviews the log files generated by servers, network devices, and even other IDPSs.

Question 15

The ____ is a federal law that creates a general prohibition on the realtime monitoring of traffic data relating to communications.

Question 16

A(n) ____ is often included in legal documents to ensure that a vendor is not liable for actions taken by a client.

Question 17

A ____ is an agency that provides physical facilities in the event of a disaster for a fee.

Question 18

A potential disadvantage of a ____ site-resumption strategy is that more than one organization might need the facility simultaneously.

Question 19

An organization aggregates all local backups to a central repository and then backs up that repository to an online vendor, with a ____ backup strategy.

Question 20

A(n) ____ is an extension of an organization’s intranet into cloud computing.

Question 21

A ____ is a synonym for a virtualization application.

Question 22

____ uses a number of hard drives to store information across multiple drive units.

Question 23

A resumption location known as a ____ is a fully configured computer facility capable of establishing operations at a moment’s notice.

Question 24

Some recovery strategies seek to improve the ____ of a server or system in addition to, or instead of, performing backups of data.

Question 25

The ____ is used to collect information directly from the end users and business managers.

Question 26

The purpose of the ____ is to define the scope of the CP operations and establish managerial intent with regard to timetables for response to incidents, recovery from disasters, and  reestablishment of operations for continuity.

Question 27

To a large extent, incident response capabilities are part of a normal IT budget. The only area in which additional budgeting is absolutely required for incident response is the maintenance of  ____.

Question 28

An manual alternative to the normal way of accomplishing an IT task might be employed in the event that IT is unavailable. This is called a ____.

Question 29

What is a common approach used in the discipline of systems analysis and design to understand the ways systems operate and to chart process flows and interdependency studies?

Question 30

Which of the following collects and provides reports on failed login attempts, probes, scans, denial-of-service attacks, and detected malware?

Question 31

The last stage of a business impact analysis is prioritizing the resources associated with the ____, which brings a better understanding of what must be recovered first.

Question 32

The final component to the CPMT planning process is to deal with ____.

Question 33

The ____ job functions and organizational roles focus on protecting the organization’s information systems and stored information from attacks.

Question 34

A(n) ____ is a detailed examination of the events that occurred, from first detection of an incident to final recovery.

Question 35

Incident analysis resources include network diagrams and lists of ____, such as database servers.

Question 36

The U.S. National Institute of Standards and Technology recommends a set of tools for the CSIRT including incident reporting mechanisms with which users can report suspected incidents. At least one of these mechanisms should permit people to report incidents ____.

Question 37

A(n) ____ is a CSIRT team member, other than the team leader, who is currently performing the responsibilities of the team leader in scanning the organization’s information infrastructure for signs of an incident.

Question 38

____ is the process of systematically examining information assets for evidentiary material that can provide insight into how an incident transpired.

Question 39

A favorite pastime of information security professionals is ____, which is a simulation of attack and defense activities using realistic networks and information systems.

Question 40

Should an incident begin to escalate, the CSIRT team leader continues to add resources and skill sets as necessary to attempt to contain and terminate the incident. The resulting team is called the ____ for this particular incident.

Question 41

General users require training on the technical details of how to do their jobs securely, including good security practices, ____ management, specialized access controls, and violation reporting.

Question 42

The ____ illustrates the most critical characteristics of information and has been the industry standard for computer security since the development of the mainframe.

Question 43

____ assigns a risk rating or score to each information asset. Although this number does not mean anything in absolute terms, it is useful in gauging the relative risk to each vulnerable information asset and facilitates the development of comparative ratings later in the risk control process.

Question 44

A ____ deals with the preparation for and recovery from a disaster, whether natural or man-made.

Question 45

A(n) ____ is any clearly identified attack on the organization’s information assets that would threaten the assets’ confidentiality, integrity, or availability.

Question 46

A ____ is a document that describes how, in the event of a disaster, critical business functions continue at an alternate location while the organization recovers its ability to function at the primary site.

Question 47

A(n) ____ is an object, person, or other entity that is a potential risk of loss to an asset.

Question 48

A(n) ____ is used to anticipate, react to, and recover from events that threaten the security of information and information assets in an organization; it is also used to restore the organization to normal modes of business operations;

Question 49

Information assets have ____ when they are not exposed (while being stored, processed, or transmitted) to corruption, damage, destruction, or other disruption of their authentic states.

Question 50