CYBR 4330 - Chapter 7 | UPDATED Questions with 100%
Verified Answers
Q1: The most critical question on the minds of an organization's
management team is
A: "What do we do once we've detected an incident?"
Q2: incident response (IR) reaction strategies
A: IR strategies
these procedures are the heart of the IR plan and the CSIRT's operations
Q3: its mission philosophy—protect and forget or apprehend and
prosecute.
A: How the CSIRT responds to an incident relies in part on
Q4: True
A: T/F: Each type of incident has its own unique characteristics that will dictate specific
preparations
Q5: an assessment of the situation.
A: After the CSIRT has been notified and arrives, whether physically or virtually, the first task
that must occur is
•During this task, the CSIRT leader (also known as the incident commander), determines
what type of incident, if any, has occurred and what reaction strategies are appropriate.
Q6: The CSIRT leader's second task is to
A: begin asserting control over the situation and make positive steps to regain control over
the organization's information assets
Q7: Response Preparation
A: •Most of the prevention strategies an organization should pursue are simply good
security practices.
•These would include the following
•Using risk assessment to make informed decisions
•Acquiring and maintaining good host security
•Acquiring and maintaining good network security
•Implementing comprehensive malware prevention
•Thorough and ongoing training to raise user awareness
Specifically designed to get both the CSIRT and the rest of the org ready to detect,
respond, and recover from the incidents
•To manage an incident, NIST recommends using a checklist
, Q8: Incident Containment
A: •This is the first phase of this part of the IR—the response function; once achieved,
eradication and recovery can occur.
begin to contain a confirmed incident
•There are a number of ways a trained CSIRT can conduct incident containment; however,
the methods that the team uses to stop an incident can have an adverse effect on the
organization and its operations.
Process by which the CSIRT acts to limit the scale and scope of an incident as it begins to
regain control over the org's info assets
•If an incident is internal, the simplest solution may be to shut down the affected systems.
•If it is external, the simplest solution may be to disconnect the affected systems from the
Internet or other external network.
CSIRT may not wish to tip off attackers
Apprpach can completely change how CSIRT responds to the incident, requiring a
measure of "acceptable loss" while the CSIRT collects info for later prosecution
CSIRT leader may also be required to notify upper management before executing a
response beyond a predetrmined level
•Close communication is a must to provide quick and effective authorization in response
to the CSIRT's findings.
Q9: •The CSIRT's operational guidance should include the
following applicable containment strategies
A: •Verifying that redundant systems and data have not been compromised
•Monitoring system and network activities
•Disabling access to compromised systems that are shared with other computers
•Changing passwords or disabling accounts of compromised systems
•Disabling system services, if possible
•Disconnecting compromised systems or networks from the local network or the Internet
•Temporarily shutting down compromised systems
Q10: Identifying the Attacking Hosts
A: •When the IR plan has been activated and the CSIRT is actively responding to the threat, it
must be able to identify the systems and network connection being used by the attacker.
•To identify the attacker the following activities should be done
•Verification of the IP address of the attacking system
•Web-based research of the attacking host IP address
•Incident/attack database searches
•Attacker back-channel and side-channel communications
Q11: Incident Eradication
A: •After the immediacy of incident containment has passed, the organization is still faced
with the contamination that inevitably results after an unauthorized access to a system.
•The attacker will most likely have left a wide swath of damage and destruction, rootkits
and back doors to allow future returns, or a "scorched earth" approach, leave malware
behind to continue the damage.
•Many practitioners feel that a compromised system can never be restored to a trusted
Verified Answers
Q1: The most critical question on the minds of an organization's
management team is
A: "What do we do once we've detected an incident?"
Q2: incident response (IR) reaction strategies
A: IR strategies
these procedures are the heart of the IR plan and the CSIRT's operations
Q3: its mission philosophy—protect and forget or apprehend and
prosecute.
A: How the CSIRT responds to an incident relies in part on
Q4: True
A: T/F: Each type of incident has its own unique characteristics that will dictate specific
preparations
Q5: an assessment of the situation.
A: After the CSIRT has been notified and arrives, whether physically or virtually, the first task
that must occur is
•During this task, the CSIRT leader (also known as the incident commander), determines
what type of incident, if any, has occurred and what reaction strategies are appropriate.
Q6: The CSIRT leader's second task is to
A: begin asserting control over the situation and make positive steps to regain control over
the organization's information assets
Q7: Response Preparation
A: •Most of the prevention strategies an organization should pursue are simply good
security practices.
•These would include the following
•Using risk assessment to make informed decisions
•Acquiring and maintaining good host security
•Acquiring and maintaining good network security
•Implementing comprehensive malware prevention
•Thorough and ongoing training to raise user awareness
Specifically designed to get both the CSIRT and the rest of the org ready to detect,
respond, and recover from the incidents
•To manage an incident, NIST recommends using a checklist
, Q8: Incident Containment
A: •This is the first phase of this part of the IR—the response function; once achieved,
eradication and recovery can occur.
begin to contain a confirmed incident
•There are a number of ways a trained CSIRT can conduct incident containment; however,
the methods that the team uses to stop an incident can have an adverse effect on the
organization and its operations.
Process by which the CSIRT acts to limit the scale and scope of an incident as it begins to
regain control over the org's info assets
•If an incident is internal, the simplest solution may be to shut down the affected systems.
•If it is external, the simplest solution may be to disconnect the affected systems from the
Internet or other external network.
CSIRT may not wish to tip off attackers
Apprpach can completely change how CSIRT responds to the incident, requiring a
measure of "acceptable loss" while the CSIRT collects info for later prosecution
CSIRT leader may also be required to notify upper management before executing a
response beyond a predetrmined level
•Close communication is a must to provide quick and effective authorization in response
to the CSIRT's findings.
Q9: •The CSIRT's operational guidance should include the
following applicable containment strategies
A: •Verifying that redundant systems and data have not been compromised
•Monitoring system and network activities
•Disabling access to compromised systems that are shared with other computers
•Changing passwords or disabling accounts of compromised systems
•Disabling system services, if possible
•Disconnecting compromised systems or networks from the local network or the Internet
•Temporarily shutting down compromised systems
Q10: Identifying the Attacking Hosts
A: •When the IR plan has been activated and the CSIRT is actively responding to the threat, it
must be able to identify the systems and network connection being used by the attacker.
•To identify the attacker the following activities should be done
•Verification of the IP address of the attacking system
•Web-based research of the attacking host IP address
•Incident/attack database searches
•Attacker back-channel and side-channel communications
Q11: Incident Eradication
A: •After the immediacy of incident containment has passed, the organization is still faced
with the contamination that inevitably results after an unauthorized access to a system.
•The attacker will most likely have left a wide swath of damage and destruction, rootkits
and back doors to allow future returns, or a "scorched earth" approach, leave malware
behind to continue the damage.
•Many practitioners feel that a compromised system can never be restored to a trusted
