الرشودي خيارات

According to the Computer Security Incident Handling Guide by NIST, incident handling is defined as:

Addressing any event that affects system performance

Responding to all types of security incidents

Only dealing with events with negative consequences

Preventing unauthorized access to sensitive data

Which of the following events can be considered security incidents?

System crashes

Packet floods

Unauthorized use of system privileges

All of the above

What is one of the challenges faced by SOCs or CSIRT teams?

Log analysis

Alert fatigue

Incident prevention

Employee training

Incident handling is not limited to intrusions and also includes:

Network vulnerabilities

System crashes

Availability issues

Loss of intellectual property

What activities are involved in the daily routine of an incident handler?

Identifying vulnerabilities in the system

Preventing system crashes

Discussing attempted system breaches

Installing antivirus software

What should an incident handler have a good understanding of?

Legal procedures

System architecture

Attacker techniques, tactics, and procedures

Cryptography algorithms

In the incident handling process, what comes after anticipating attacks?

Incident containment

Incident detection

Incident preparation

Incident eradication

How many phases does the incident handling process consist of, according to NIST?

Tow

Three

Four

Five

Which phase of the incident handling process involves maintaining a chain of custody of actions?

Preparation

Detection & Analysis

Containment, Eradication & Recovery

Post-Incident Activity

What term is used to describe the four phases of the incident handling process?

Incident response life cycle

Incident mitigation framework

Incident resolution model

Incident prevention strategy

What is included in the Preparation phase of the incident handling process?

Employee documentation

Efensive measures

Incident response team training

All of the above

What should be determined during the Preparation phase?

Minimum time to respond to incidents

Incident severity classification

Legal department recommendations

Network architecture design

What tools or measures should be in place for effective incident handling preparation?

Well-defined policies

Well-defined response procedures

Threat intelligence integration

All of the above

What is the purpose of logically categorizing the network in incident detection?

To prioritize incident response activities

To identify potential vulnerabilities

To establish communication protocols

To identify potential attackers

Which level of detection involves analyzing packets crossing the network?

Network perimeter

Host perimeter

Host-level

Application-level

What tool can assist in network perimeter detection?

Antivirus software

Intrusion Detection System (IDS)

Network firewall

Endpoint Detection and Response (EDR) system

Network Packet analysis can help with:

Understanding network characteristics

Learning who is on a network

Identifying peak network usage times

All of the above

What is an effective way to establish levels of detection and logically categorize a network for incident detection and analysis?

Analyzing system logs and user behavior

Monitoring network traffic using intrusion detection systems

Considering levels such as network perimeter, host perimeter, host-level, and application-leve

Implementing strong access controls and authentication mechanisms

How Packet Sniffers Work ?

Collection: the packet sniffer collects raw binary data from the wire.

Conversion: the captured binary data is converted into a read- able form.

Analysis: the packet sniffer conducts an analysis of the captured and converted data.

All of the above

Containment phase is divided into the following subphases:

Short-term Containment

System Back-up

Long-term Containment

All of the above

The storage mediums can be arranged from the most volatile to the least, as follows

HDD -registers - CPU cache - Ram - External and secondary storage devices

Registers - CPU cache - Ram - HDD - External and secondary storage devices

CPU cache - Ram - HDD - registers - External and secondary storage devices

Ram - registers - CPU cache - HDD - External and secondary storage devices

Data acquisition techniques and methods can be divided into:

Static and Fixed acquisition

Dynamic live and Flexible acquisition

Static and Dynamic live acquisition

All of the above

الرشودي خيارات

More Quizzes