CySA+ Domain 3: Incident Response and Management
Test with all Correct & 100% Verified Answers |Already
Graded A+
event ✔Correct Answer-any observable occurrence in a system or network
adverse event ✔Correct Answer-any event that has negative consequences
security incident ✔Correct Answer-a violation or imminent threat of violation of computer
security policies, acceptable use policies, or standard security practices.
computer security incident response teams (CSIRTs) ✔Correct Answer-responsible for
responding to computer security incidents that occur within an organization by following
standardized response procedures and incorporating their subject matter expertise and
professional judgment
Preparation
Detection & Analysis
Containment, Eradication, & Recovery
Post-Incident Activity ✔Correct Answer-incident response process
alerts
logs
publicly available info
people ✔Correct Answer-four major categories of security event indicators
procedures ✔Correct Answer-detailed, tactical info that CSIRT members need when
responding to an incident
playbooks ✔Correct Answer-describe the specific procedures that the CSIRT will follow in the
event of a specific type of cybersecurity incident
external/removable media ✔Correct Answer-an attack executed from removable media or a
peripheral device
attrition ✔Correct Answer-an attack that employs brute-force methods to compromise,
degrade, or destroy systems, networks, or services
web ✔Correct Answer-an attack executed from a website or web-based applications
email ✔Correct Answer-an attack executed via an email message or attachment
, impersonation ✔Correct Answer-an attack involving replacement of something benign with
something malicious
improper usage ✔Correct Answer-any incident resulting from violation of an organization's
acceptable usage policies by an authorized user
loss or theft of equipment ✔Correct Answer-the loss or theft of a computing device or media
used by the organization
unknown ✔Correct Answer-attack of unknown origin
other ✔Correct Answer-attack of known origin that does not fit into any other attack vector
categories
scope of impact ✔Correct Answer-depends on the degree of impairment that it causes the
organization as well as the effort required to recover from the incident
functional impact ✔Correct Answer-degree of impairment that it causes to the organization
no functional impact ✔Correct Answer-No effect to the organization's ability to provide all
services to all users.
low functional impact ✔Correct Answer-Minimal effect; the organization can still provide all
critical services to all users but has lost efficiency
medium functional impact ✔Correct Answer-The organization has lost the ability to provide a
critical service to a subset of system users
high functional impact ✔Correct Answer-The organization is no longer able to provide some
critical services to any users
no economic impact ✔Correct Answer-The organization does not expect to experience any
financial impact or the financial impact is negligible.
low economic impact ✔Correct Answer-The organization expects to experience a financial
impact of $10,000 or less.
medium economic impact ✔Correct Answer-The organization expects to experience a
financial impact of more than $10,000 but less than $500,000.
high economic impact ✔Correct Answer-The organization expects to experience a financial
impact of $500,000 or more.
Test with all Correct & 100% Verified Answers |Already
Graded A+
event ✔Correct Answer-any observable occurrence in a system or network
adverse event ✔Correct Answer-any event that has negative consequences
security incident ✔Correct Answer-a violation or imminent threat of violation of computer
security policies, acceptable use policies, or standard security practices.
computer security incident response teams (CSIRTs) ✔Correct Answer-responsible for
responding to computer security incidents that occur within an organization by following
standardized response procedures and incorporating their subject matter expertise and
professional judgment
Preparation
Detection & Analysis
Containment, Eradication, & Recovery
Post-Incident Activity ✔Correct Answer-incident response process
alerts
logs
publicly available info
people ✔Correct Answer-four major categories of security event indicators
procedures ✔Correct Answer-detailed, tactical info that CSIRT members need when
responding to an incident
playbooks ✔Correct Answer-describe the specific procedures that the CSIRT will follow in the
event of a specific type of cybersecurity incident
external/removable media ✔Correct Answer-an attack executed from removable media or a
peripheral device
attrition ✔Correct Answer-an attack that employs brute-force methods to compromise,
degrade, or destroy systems, networks, or services
web ✔Correct Answer-an attack executed from a website or web-based applications
email ✔Correct Answer-an attack executed via an email message or attachment
, impersonation ✔Correct Answer-an attack involving replacement of something benign with
something malicious
improper usage ✔Correct Answer-any incident resulting from violation of an organization's
acceptable usage policies by an authorized user
loss or theft of equipment ✔Correct Answer-the loss or theft of a computing device or media
used by the organization
unknown ✔Correct Answer-attack of unknown origin
other ✔Correct Answer-attack of known origin that does not fit into any other attack vector
categories
scope of impact ✔Correct Answer-depends on the degree of impairment that it causes the
organization as well as the effort required to recover from the incident
functional impact ✔Correct Answer-degree of impairment that it causes to the organization
no functional impact ✔Correct Answer-No effect to the organization's ability to provide all
services to all users.
low functional impact ✔Correct Answer-Minimal effect; the organization can still provide all
critical services to all users but has lost efficiency
medium functional impact ✔Correct Answer-The organization has lost the ability to provide a
critical service to a subset of system users
high functional impact ✔Correct Answer-The organization is no longer able to provide some
critical services to any users
no economic impact ✔Correct Answer-The organization does not expect to experience any
financial impact or the financial impact is negligible.
low economic impact ✔Correct Answer-The organization expects to experience a financial
impact of $10,000 or less.
medium economic impact ✔Correct Answer-The organization expects to experience a
financial impact of more than $10,000 but less than $500,000.
high economic impact ✔Correct Answer-The organization expects to experience a financial
impact of $500,000 or more.
