Midterm Review 2

Which of the following statements is true regarding precautions you should take when looking for forensic tools on the Internet?

• If the tool is accurate, there should be no problems using it.

• You must be certified in this tool in case you have to go to court.

• The tool must be endorsed by the FBI.

• You need to be verify that the tool is not considered junk science.

You have been called to analyze a company computer that has potentially stolen information. What is your first step?

• Obtain a search warrant

• Install a write-blocker to the system

• Shut the system off to prevent remote access

• Install Encase on the machine to begin the forensic search

The FBI has a permanent team of computer forensics. They call their team the ____ team.

• CIRT

• CART

• RCFL

• First-response

In addition to having a solid foundation in computer forensics, a technician should have some expertise and understanding of ____.

• business management

• engineering

• criminal justice

• analytics

After an incident is isolated or contained, what does the SANS institute suggest as the next phase?

• Eradication

• Recovery

• Identification

• Lessons learned

How does incident response differ from risk management?

• Risk management provides the steps for an incident response.

• Risk management is performed by first responders, and incident response is performed by the CSIRT.

• Risk management is optional; incident response is mandatory.

• Risk management helps analyze and set prevention strategies, and incident response consists of the steps to follow if an incident still occurs

A user responded to a phishing e-mail and provided some company data as a result. After the incident is contained, which of the following would be done in the lessons learned stage of the IRP?

• Install encrypted an e-mail system

• Review the annual training procedures on phishing

• Have the employee who opened the e-mail explain why they answered the e-mail

• Update the risk assessment procedures for e-mail usage

Malicious software is found on a computer located on the company’s network. What is the first step in this incident?

• Take a photograph of the work area

• Disconnect the computer from the network

• Turn the computer off

• Run anti-malware software

Which act mandates that federal agencies document and report security incidents annually?

• NCCIC

• HIPAA

• FISMA

• SOX

Which of these situations would not likely be classified as a security incident?

• The human resources specialist forgot their password.

• Personal student information was exposed on a public website.

• A user plugged in an unknown USB stick into a computer on the company network

• Several users are receiving phishing e-mails.