FEDVTE Actual Questions and Correct Answers
Q1
False Information sharing only aligns with the respond process in incident management
activities. False
Answer: False
Q2
Sensors are defined only as technical or information systems. False Eradication consists of
short-term, tactical actions. False Containment strategies may include: Rebuilding systems from
original media Remediating vulnerabilities Leaving systems online Shutting down a service
Answer: False
Q3
What systems can be isolated or shutdown Who to notify when handling certain incidents All of
the above None of the above
Answer: All of the above
Q4
What are the three impact attributes described in the course material? Function, Availability,
Impact Availability, Information, Confidentiality Function, Information, Recoverability
Recoverability, Externality, Impact
Answer: Function, Availability, Impact
Q5
Which of the following is NOT an approach for institu-tionalizing an incident management
capability? D. CRITS C. Red team National CSIRT Network and security operations center (NSOC)
Red team Crisis management team Security incident response team
Answer: CRITS
Q6
Elements of situational awareness are only technical in B. False nature. False
Answer: False
, Q7
Which of the following are NOT considered indicators of compromise (IOCs)? Domain names
Virus signatures Timestamps Registry keys
Answer: Domain names
Q8
Postmortems can be done after an incident to identi-fy: What went right
Answer: Postmortems can be done after an incident to identi-fy: What went right
Q9
What went wrong Training needs Tools needed A and B only C and D only B and C only None of
the above All of the above
Answer: Training needs
Q10
Fusion is the correlation and analysis of information collected from an incident report. False B.
Improving network and host security
Answer: False
Q11
Which of the following resources will facilitate incident E. All of the above management
activities? A communication plan Data classification schema Network topologies and baselines
Points of Contact (POC) lists All of the above None of the above
Answer: management activities?
Q12
Which of the following is NOT considered a type of analysis? Triage Situational analysis B.
Situational analysis Media analysis Mitigation analysis
Answer: Situational analysis
Q13
Which of the following is NOT a response sub-process? B. Performing malware analysis Planning
the response strategy Performing malware analysis Coordinating response Communicating with
stakeholders
Answer: analysis
Q1
False Information sharing only aligns with the respond process in incident management
activities. False
Answer: False
Q2
Sensors are defined only as technical or information systems. False Eradication consists of
short-term, tactical actions. False Containment strategies may include: Rebuilding systems from
original media Remediating vulnerabilities Leaving systems online Shutting down a service
Answer: False
Q3
What systems can be isolated or shutdown Who to notify when handling certain incidents All of
the above None of the above
Answer: All of the above
Q4
What are the three impact attributes described in the course material? Function, Availability,
Impact Availability, Information, Confidentiality Function, Information, Recoverability
Recoverability, Externality, Impact
Answer: Function, Availability, Impact
Q5
Which of the following is NOT an approach for institu-tionalizing an incident management
capability? D. CRITS C. Red team National CSIRT Network and security operations center (NSOC)
Red team Crisis management team Security incident response team
Answer: CRITS
Q6
Elements of situational awareness are only technical in B. False nature. False
Answer: False
, Q7
Which of the following are NOT considered indicators of compromise (IOCs)? Domain names
Virus signatures Timestamps Registry keys
Answer: Domain names
Q8
Postmortems can be done after an incident to identi-fy: What went right
Answer: Postmortems can be done after an incident to identi-fy: What went right
Q9
What went wrong Training needs Tools needed A and B only C and D only B and C only None of
the above All of the above
Answer: Training needs
Q10
Fusion is the correlation and analysis of information collected from an incident report. False B.
Improving network and host security
Answer: False
Q11
Which of the following resources will facilitate incident E. All of the above management
activities? A communication plan Data classification schema Network topologies and baselines
Points of Contact (POC) lists All of the above None of the above
Answer: management activities?
Q12
Which of the following is NOT considered a type of analysis? Triage Situational analysis B.
Situational analysis Media analysis Mitigation analysis
Answer: Situational analysis
Q13
Which of the following is NOT a response sub-process? B. Performing malware analysis Planning
the response strategy Performing malware analysis Coordinating response Communicating with
stakeholders
Answer: analysis
