Mod 9

Open Ended

How do you think the process of incident recovery can impact an organization's overall cybersecurity strategy?

Multiple Choice

Why is it important for the CSIRT to assess the full extent of damage after an incident has been contained?

• To determine what must be done to restore systems

• To punish those responsible for the incident

• To notify law enforcement

• To ignore minor damages

Multiple Choice

Which of the following is the initial step in the recovery process after a security incident?

• Incident damage assessment

• Restoring data from backups

• Validating security controls

• Identifying and fixing vulnerabilities

Multiple Select

Which of the following are main goals of the recovery phase after an incident?

• Identify and fix vulnerabilities

• Restore affected data and systems

• Re-enable affected business processes

• Install new software unrelated to the incident

Open Ended

Explain why documentation, communication, and validation are emphasized during the recovery process after a security incident.

Open Ended

Describe the role of digital forensics in identifying and resolving vulnerabilities after a security incident.

Multiple Select

Which of the following best practices should be followed during data restoration to avoid reintroducing compromised files or malware?

• Verify that backup data was not infected

• Conduct hash checks to ensure data integrity

• Use offline or immutable backups whenever possible

• Restore all files without verification

Open Ended

Describe how real-time monitoring contributes to the prevention of reinfection attempts after restoring business services.

Multiple Choice

Which of the following is a key step in restoring services and processes after a cybersecurity incident?

• Delaying business continuity operations

• Ignoring penetration testing

• Conducting staged activation of systems

• Disabling real-time monitoring

Open Ended

Explain why restoring confidence across the organization after an incident is not just a technical challenge.

Multiple Choice

Incident response plans must be updated to match which of the following changes?

• New technologies and threat vectors

• Changes in staff or leadership

• Updated legal or compliance obligations

• All of the above

Multiple Choice

What is the primary purpose of examining documentation during an After-Action Review (AAR)?

• To assign blame for mistakes

• To reveal the timeline and response to the incident

• To punish underperforming staff

• To ignore lessons learned

Multiple Choice

Which of the following is a benefit of using the After-Action Review (AAR) as a historical record of events?

• It helps in establishing a timeline of events from multiple sources.

• It ensures immediate recovery of data and systems.

• It prevents future incidents from occurring.

• It eliminates the need for CSIRT response.

Multiple Choice

How does studying AAR reports from past incidents help new members of an IR team?

• It makes them experts in all security technologies.

• It familiarizes them with the system, plans, and responses of the organization.

• It guarantees they will never make mistakes.

• It allows them to avoid all future incidents.

Multiple Choice

Why is an after-action review (AAR) valuable?

• It can be used to document lessons learned and generate improvements to the IR plan.

• It can provide a historical record of events.

• It formally brings the IR team’s actions to a close after an incident.

• All of the above are true.

Multiple Choice

Which of the following are important components of an effective training plan for incident response?

• Provisioning of actual or contingent credentials

• Cross-training of staff members

• Ensuring a sufficient pool of qualified staff

• All of the above

Multiple Choice

CSIRT Team member training __________.

• should include cross-training of members

• should ensure that all people on the team are individually trained to only perform their job

• includes training for all personnel of the team to handle public press briefings

• includes training for all personnel to be highly proficient in linux and penetration testing

Open Ended

How do rehearsals, such as tabletop exercises and red team drills, contribute to the effectiveness of a CSIRT team?

Multiple Select

Which of the following are advantages of involving law enforcement agencies during a serious incident?

• Better equipped at processing evidence than business organizations

• Can handle warrants and subpoenas

• May do more harm than good when extracting information

• Adept at obtaining statements and required documents

Multiple Choice

When must an organization notify law enforcement authorities about an incident?

• Only if requested by law enforcement

• Whenever there is a data breach

• When evidence is lost

• When an incident violates civil or criminal law

Open Ended

What are some potential disadvantages for organizations when involving law enforcement in incident response?

Multiple Choice

Breach notification requirements in the Gramm-Leach-Bliley (GLB) Act apply to __________.

• Healthcare organizations

• Financial institutions

• Breaches of government

• Private industries

Multiple Choice

Forensics involves the collection and presentation of materials in a legal proceeding, usually called "evidence," but only what a judge admits in court can truly be considered evidence; the correct term is ______.

• evidentiary material

• legal data

• collected analysis

• forensic files

Multiple Choice

A digital investigation begins with _____.

• an allegation of wrongdoing

• collection of digital evidence

• analysis using digital and electronic forensic techniques

• a grand jury investigation

Multiple Choice

After the incident, _______.

• safeguards can be removed, and business may resume as it had previously

• controls that had been insufficient before the incident must be replaced, upgraded, or fixed

• restore previous monitoring capabilities

• outsource all monitoring and response processes

Open Ended

Identify some common certifications for digital forensic practitioners:

Open Ended

Reflecting on today's lesson about incident recovery, what is one key step you would take if you were part of a CSIRT team responding to a security incident?