CIS 359 Midterm Exam Set 1

Order ready-to-submit essays. No Plagiarism Guarantee!

Note:  All our papers are written from scratch by human writers to ensure authenticity and originality.

Question 1

A CSIRT model that is effective for large organizations and for organizations with major computing resources at distant locations is the __.

Question 2

The first group to communicate the CSIRT’s vision and operational plan is the managerial team or individual serving as the __.

Question 3

Those services performed in response to a request or a defined event such as a help desk alert are called __.

Question 4

One way to build and maintain staff skills is to develop incident-handling __ and have the team members discuss how they would handle them.

Question 5

Giving the IR team the responsibility for __ is generally not recommended.

Question 6

When an organization completely outsources its IR work, typically to an on-site contractor, it is called a(n) __ model.

Question 7

The focus during a(n) __ is on learning what worked, what didn’t, and where communications and response procedures may have failed.

Question 8

Those services undertaken to prepare the organization or the CSIRT constituents to protect and secure systems in anticipation of problems, attacks, or other events are called __.

Question 9

__ are closely monitored network decoys serving that can distract adversaries from more valuable machines on a network; can provide early warning about new attack and exploitation trends; and can allow in-depth examination of adversaries during and after exploitation.

Question 10

Using a process known as __, network-based IDPSs look for attack patterns by comparing measured activity to known signatures in their knowledge base to determine whether or not an attack has occurred or may be under way.

Question 11

In an attack known as __, valid protocol packets exploit poorly configured DNS servers to inject false information to corrupt the servers’ answers to routine DNS queries from other systems on that network.

Question 12

The use of IDPS sensors and analysis systems can be quite complex. One very common approach is to use an open source software program called __ running on an open source UNIX or Linux system that can be managed and queried from a desktop computer using a client interface.

Question 13

The __ approach for detecting intrusions is based on the frequency with which certain network activities take place.

Question 14

A(n) __ , a type of IDPS that is similar to the NIDPS, reviews the log files generated by servers, network devices, and even other IDPSs.

Question 15

The __ is a federal law that creates a general prohibition on the realtime monitoring of traffic data relating to communications.

Question 16

A(n) __ is often included in legal documents to ensure that a vendor is not liable for actions taken by a client.

Question 17

A __ is an agency that provides physical facilities in the event of a disaster for a fee.

Question 18

A potential disadvantage of a __ site-resumption strategy is that more than one organization might need the facility simultaneously.

Question 19

An organization aggregates all local backups to a central repository and then backs up that repository to an online vendor, with a __ backup strategy.

Question 20

A(n) __ is an extension of an organization’s intranet into cloud computing.

Question 21

A __ is a synonym for a virtualization application.

Question 22

__ uses a number of hard drives to store information across multiple drive units.

Question 23

A resumption location known as a __ is a fully configured computer facility capable of establishing operations at a moment’s notice.

Question 24

Some recovery strategies seek to improve the __ of a server or system in addition to, or instead of, performing backups of data.

Question 25

The __ is used to collect information directly from the end users and business managers.

Question 26

The purpose of the __ is to define the scope of the CP operations and establish managerial intent with regard to timetables for response to incidents, recovery from disasters, and reestablishment of operations for continuity.

Question 27

To a large extent, incident response capabilities are part of a normal IT budget. The only area in which additional budgeting is absolutely required for incident response is the maintenance of __.

Question 28

An manual alternative to the normal way of accomplishing an IT task might be employed in the event that IT is unavailable. This is called a __.

Question 29

What is a common approach used in the discipline of systems analysis and design to understand the ways systems operate and to chart process flows and interdependency studies?

Question 30

Which of the following collects and provides reports on failed login attempts, probes, scans, denial-of-service attacks, and detected malware?

Question 31

The last stage of a business impact analysis is prioritizing the resources associated with the __, which brings a better understanding of what must be recovered first.

Question 32

The final component to the CPMT planning process is to deal with __.

Question 33

The __ job functions and organizational roles focus on protecting the organization’s information systems and stored information from attacks.

Question 34

A(n) __ is a detailed examination of the events that occurred, from first detection of an incident to final recovery.

Question 35

Incident analysis resources include network diagrams and lists of __, such as database servers.

Question 36

The U.S. National Institute of Standards and Technology recommends a set of tools for the CSIRT including incident reporting mechanisms with which users can report suspected incidents. At least one of these mechanisms should permit people to report incidents __.

Question 37

A(n) __ is a CSIRT team member, other than the team leader, who is currently performing the responsibilities of the team leader in scanning the organization’s information infrastructure for signs of an incident.

Question 38

__ is the process of systematically examining information assets for evidentiary material that can provide insight into how an incident transpired.

Question 39

A favorite pastime of information security professionals is __, which is a simulation of attack and defense activities using realistic networks and information systems.

Question 40

Should an incident begin to escalate, the CSIRT team leader continues to add resources and skill sets as necessary to attempt to contain and terminate the incident. The resulting team is called the __ for this particular incident.

Question 41

General users require training on the technical details of how to do their jobs securely, including good security practices, __ management, specialized access controls, and violation reporting.

Question 42

The __ illustrates the most critical characteristics of information and has been the industry standard for computer security since the development of the mainframe.

Question 43

__ assigns a risk rating or score to each information asset. Although this number does not mean anything in absolute terms, it is useful in gauging the relative risk to each vulnerable information asset and facilitates the development of comparative ratings later in the risk control process.

Question 44

A __ deals with the preparation for and recovery from a disaster, whether natural or man-made.

Question 45

A(n) __ is any clearly identified attack on the organization’s information assets that would threaten the assets’ confidentiality, integrity, or availability.

Question 46

A __ is a document that describes how, in the event of a disaster, critical business functions continue at an alternate location while the organization recovers its ability to function at the primary site.

Question 47

A(n) __ is an object, person, or other entity that is a potential risk of loss to an asset.

Question 48

A(n) __ is used to anticipate, react to, and recover from events that threaten the security of information and information assets in an organization; it is also used to restore the organization to normal modes of business operations;

Question 49

Information assets have __ when they are not exposed (while being stored, processed, or transmitted) to corruption, damage, destruction, or other disruption of their authentic states.

Question 50

__ hack systems to conduct terrorist activities through network or Internet pathways.