Incident response Exam 3 study guide questions
with accurate answers
____ disasters include acts of terrorism and acts of war. Ans✓✓✓Man-
made
____ incidents are predominantly characterized as a violation of policy
rather than an effort to abuse existing systems. Ans✓✓✓Inappropriate
use
____ involves an attempt made by those who may become subject to
digital forensic techniques to obfuscate or hide items of evidentiary
value. Ans✓✓✓Anti-forensics
____ may be caused by earthquakes, floods, storm winds, tornadoes, or
mud flows. Ans✓✓✓. Rapid onset disasters
____ means making an organization ready for possible contingencies
that can escalate to become disasters. Ans✓✓✓Preparation
____________________ is a category of incidents that covers a
spectrum of violations made by authorized users of a system who
nevertheless use the system in ways specifically prohibited by
management. Ans✓✓✓Inappropriate Use (IU)
____________________ testing can come from standardization boards
or consultants (for example, ISO 9000), certification or accreditation
,groups, or a group selected by the organization's management from a
sister company. Ans✓✓✓External
____________________ testing can include employees conducting self-
assessments after an exercise by completing feedback surveys indicating
what they thought worked well and what did not. Ans✓✓✓Internal
______________________________ is the preparation for and recovery
from a disaster, whether natural or man-made. Ans✓✓✓Disaster
recovery planning
A ____ is a small quantity of data kept by a Web site as a means of
recording that a system has visited that Web site. Ans✓✓✓cookie
A business continuity plan should be a single unified plan.
Ans✓✓✓False
A certification offered by the Business Continuity Institute is called
____. Ans✓✓✓BCI Professional Recognition Program
A continuously changing process presents challenges in acquisition, as
there is not a fixed state that can be collected, hashed, and so forth. This
has given rise to the concept of ____ forensics which captures a point-
in-time picture of a process. Ans✓✓✓snapshot
, A DR plan addendum should include the trigger, the ____ method, and
the response time associated with each disaster situation.
Ans✓✓✓notification
A forensics team typically uses two methods to document a scene as it
exists at the time of arrival: photography and ____. Ans✓✓✓field notes
A search is constitutional if it does not violate a person's reasonable or
legitimate____. Ans✓✓✓expectation of privacy
A search that is constrained to a specific focus Ans✓✓✓Permissible in
scope
An ____ may escalate into a disaster when it grows in scope and
intensity. Ans✓✓✓incident
An increasing concern for privacy and widespread availability of
encryption products has led to the use of encryption for individual files
and even entire devices. Briefly discuss the current state of encryption
with respect to forensic investigation. Ans✓✓✓Although some
encryption is poorly done and is easily broken, high-quality products are
increasingly available that use good encryption algorithms beyond our
current capability to reverse encryption by trying all possible
combinations. Encrypted information poses significant challenges to
forensic investigators because, by its nature, encryption conceals the
content of digital material. Many encryption products require input of an
encryption key when the user logs on and then decrypts the user's
information on the fly. When the system goes into screen saver mode or
with accurate answers
____ disasters include acts of terrorism and acts of war. Ans✓✓✓Man-
made
____ incidents are predominantly characterized as a violation of policy
rather than an effort to abuse existing systems. Ans✓✓✓Inappropriate
use
____ involves an attempt made by those who may become subject to
digital forensic techniques to obfuscate or hide items of evidentiary
value. Ans✓✓✓Anti-forensics
____ may be caused by earthquakes, floods, storm winds, tornadoes, or
mud flows. Ans✓✓✓. Rapid onset disasters
____ means making an organization ready for possible contingencies
that can escalate to become disasters. Ans✓✓✓Preparation
____________________ is a category of incidents that covers a
spectrum of violations made by authorized users of a system who
nevertheless use the system in ways specifically prohibited by
management. Ans✓✓✓Inappropriate Use (IU)
____________________ testing can come from standardization boards
or consultants (for example, ISO 9000), certification or accreditation
,groups, or a group selected by the organization's management from a
sister company. Ans✓✓✓External
____________________ testing can include employees conducting self-
assessments after an exercise by completing feedback surveys indicating
what they thought worked well and what did not. Ans✓✓✓Internal
______________________________ is the preparation for and recovery
from a disaster, whether natural or man-made. Ans✓✓✓Disaster
recovery planning
A ____ is a small quantity of data kept by a Web site as a means of
recording that a system has visited that Web site. Ans✓✓✓cookie
A business continuity plan should be a single unified plan.
Ans✓✓✓False
A certification offered by the Business Continuity Institute is called
____. Ans✓✓✓BCI Professional Recognition Program
A continuously changing process presents challenges in acquisition, as
there is not a fixed state that can be collected, hashed, and so forth. This
has given rise to the concept of ____ forensics which captures a point-
in-time picture of a process. Ans✓✓✓snapshot
, A DR plan addendum should include the trigger, the ____ method, and
the response time associated with each disaster situation.
Ans✓✓✓notification
A forensics team typically uses two methods to document a scene as it
exists at the time of arrival: photography and ____. Ans✓✓✓field notes
A search is constitutional if it does not violate a person's reasonable or
legitimate____. Ans✓✓✓expectation of privacy
A search that is constrained to a specific focus Ans✓✓✓Permissible in
scope
An ____ may escalate into a disaster when it grows in scope and
intensity. Ans✓✓✓incident
An increasing concern for privacy and widespread availability of
encryption products has led to the use of encryption for individual files
and even entire devices. Briefly discuss the current state of encryption
with respect to forensic investigation. Ans✓✓✓Although some
encryption is poorly done and is easily broken, high-quality products are
increasingly available that use good encryption algorithms beyond our
current capability to reverse encryption by trying all possible
combinations. Encrypted information poses significant challenges to
forensic investigators because, by its nature, encryption conceals the
content of digital material. Many encryption products require input of an
encryption key when the user logs on and then decrypts the user's
information on the fly. When the system goes into screen saver mode or
