Chapter 12: Incident Response, Forensics, & Recovery
questions with accurate answers
1 Ans✓✓✓Your network performs a full backup every night. Each
Sunday, the previous night's backup tape is archived.
On a Wednesday morning, the storage system fails. How many restore
operations would you need to perform to recover all of the data?
-1
-2
-3
-4
-5
-6
2 Ans✓✓✓Your network uses the following backup strategy:
Full backups every Sunday night
Differential backups Monday night through Saturday night
On Thursday morning, the storage system fails. How many restore
operations would you need to perform to recover all of the data?
-1
-2
-3
-4
,-5
3 Ans✓✓✓You have been asked to implement a RAID 5 solution for
your network. What is the minimum number of hard disks that can be
used to configure RAID 5?
-2
-3
-4
-5
-6
4 Ans✓✓✓Your network uses the following backup strategy:
Full backups every Sunday night
Incremental backups Monday night through Saturday night
On a Thursday morning, the storage system fails. How many restore
operations would you need to perform to recover all of the data?
-1
-2
-3
-4
-5
,A system image backup consists of an entire volume backed up to .vhd
files.
A system image contains everything on the system volume, including
the operating system, installed programs, drivers, and user data files.
Ans✓✓✓Which of the following describes a system image backup?
(Select two.)
-A system image only contains the operating system, installed programs,
drivers, and user profile settings.
-A system image includes only specified files and folders backed up to a
compressed file.
-A system image does not include operating system files, program files,
encrypted files, files in the Recycle Bin, user profile settings, or
temporary files.
-A system image backup consists of an entire volume backed up to .vhd
files.
-A system image contains everything on the system volume, including
the operating system, installed programs, drivers, and user data files.
Alerts Ans✓✓✓Which of the following components are the SIEM's
way of letting the IT team know that a pre-established parameter is not
within the acceptable range?
-Sensors
-Trends
-Dashboard
, -Alerts
Application log Ans✓✓✓Some users report that frequent system
crashes have started happening on their workstations. Upon further
investigation, you notice that these users all have the same application
installed that has been recently updated. Where would you go to conduct
a root cause analysis?
-Firewall log
-Network log
-Application log
-Security log
ARP poisoning Ans✓✓✓The MAC address of the attacker can be
associated with the IP address of another host.
-MAC spoofing
-MAC flooding
ARP poisoning
-Port mirroring
Back up all log files and audit trails. Ans✓✓✓Which of the following is
an important aspect of evidence-gathering?
-Back up all log files and audit trails.
questions with accurate answers
1 Ans✓✓✓Your network performs a full backup every night. Each
Sunday, the previous night's backup tape is archived.
On a Wednesday morning, the storage system fails. How many restore
operations would you need to perform to recover all of the data?
-1
-2
-3
-4
-5
-6
2 Ans✓✓✓Your network uses the following backup strategy:
Full backups every Sunday night
Differential backups Monday night through Saturday night
On Thursday morning, the storage system fails. How many restore
operations would you need to perform to recover all of the data?
-1
-2
-3
-4
,-5
3 Ans✓✓✓You have been asked to implement a RAID 5 solution for
your network. What is the minimum number of hard disks that can be
used to configure RAID 5?
-2
-3
-4
-5
-6
4 Ans✓✓✓Your network uses the following backup strategy:
Full backups every Sunday night
Incremental backups Monday night through Saturday night
On a Thursday morning, the storage system fails. How many restore
operations would you need to perform to recover all of the data?
-1
-2
-3
-4
-5
,A system image backup consists of an entire volume backed up to .vhd
files.
A system image contains everything on the system volume, including
the operating system, installed programs, drivers, and user data files.
Ans✓✓✓Which of the following describes a system image backup?
(Select two.)
-A system image only contains the operating system, installed programs,
drivers, and user profile settings.
-A system image includes only specified files and folders backed up to a
compressed file.
-A system image does not include operating system files, program files,
encrypted files, files in the Recycle Bin, user profile settings, or
temporary files.
-A system image backup consists of an entire volume backed up to .vhd
files.
-A system image contains everything on the system volume, including
the operating system, installed programs, drivers, and user data files.
Alerts Ans✓✓✓Which of the following components are the SIEM's
way of letting the IT team know that a pre-established parameter is not
within the acceptable range?
-Sensors
-Trends
-Dashboard
, -Alerts
Application log Ans✓✓✓Some users report that frequent system
crashes have started happening on their workstations. Upon further
investigation, you notice that these users all have the same application
installed that has been recently updated. Where would you go to conduct
a root cause analysis?
-Firewall log
-Network log
-Application log
-Security log
ARP poisoning Ans✓✓✓The MAC address of the attacker can be
associated with the IP address of another host.
-MAC spoofing
-MAC flooding
ARP poisoning
-Port mirroring
Back up all log files and audit trails. Ans✓✓✓Which of the following is
an important aspect of evidence-gathering?
-Back up all log files and audit trails.
