Incident Response-Quiz 1

Incidents are

• adverse events

• with negative consequences

• malicious intent to harm

• all of the above

Answer explanation

The goals of incident response may depends on factors below: (choose 2)

• The victim’s needs

• Provide rapid detection and containment

• The severity of incident

Concept of the attack lifecycle:________________________
the attacker successfully executes malicious code on one or more systems

• Escalate privileges

• Initial compromise

• Establish foothold

• Maintain presence

Tools to create forensic images (choose TWO)

• Guidance Software EnCase

• Ubuntu

• AccessData FTK Imager

• Kali Linux

Why performing a live system duplication has much greater risk than performing a

static image?

• live image will make minor modifications to the system, but you

  will be able to get an image

• the system may be an extremely business-critical system that cannot be

  taken down except during very short maintenance windows

• no hardware write blocker preventing you from

  destroying evidence

• system or backup system restrictions

The philosophy behind the incident preparation is to

• create an infrastructure that provides rapid answers to the questions you will have after an incident occurs

• Identify your corporate risk

• Create a response toolkit for use by the CSIRT

• prepare the host for the incident

Example of critical assets (choose 3)

• Corporate reputation

• Confidential business information

• Nonpublic personally identifiable information

• business information

Initial Response Step:

Incident Detection>Initial Notification of Incident> M > Incident Declaration> P

• M=Assembling the CSIRT, P= Record Details

• M= Assembling Details, P=Record Declaration

• M=Record Details, P= Assembling the CSIRT

• M=Assembling Escalation, P= Record Team

Implementing a strong _______________________ requires the participation by all employees

• notification procedure

• incident response program

• computer security awareness

• initial response checklist

Goal of Initial Response Checklists: (choose 2)

• To prevent "knee jerk" reactions and panic when incident is detected

• For recording details after the initial notification of an incident

• As the mechanism to record the circumstances surrounding a reported incident

• To obtain enough information to determine appropriate response