U11-D2,E1-recap

What is the term for an agreement between an organisation and an external service provider that covers the provision of cloud, hardware, or software services?

• Service level agreement

• External service provider agreement

• Cloud service agreement

• Hardware service agreement

What is one of the implications of external service provider agreements for data security?

• The organisation has no responsibility for data security

• The organisation has to encrypt all data before sending it to the external service provider

• The organisation has to comply with the data security obligations of the external service provider

• The organisation has to store a copy of all data locally

What is one of the challenges of live forensics on a desktop system?

• Confiscating the device without alerting the user

• Taking an image of the system without altering the data

• Using a forensic analysis tool without installing it on the system

• Reviewing files and settings without opening them

What is the purpose of forensic collection of evidence following a security incident?

• To identify the cause and extent of the incident

• To recover the lost or damaged data

• To prevent future incidents from occurring

• To punish the perpetrators of the incident

What is the difference between passive and active analysis tools for network forensics?

• Passive tools monitor network traffic without interfering with it, while active tools send packets or requests to the network

• Passive tools analyse network traffic after it has been captured, while active tools analyse network traffic in real time

• Passive tools analyse network traffic from a single point, while active tools analyse network traffic from multiple points

• Passive tools analyse network traffic for anomalies, while active tools analyse network traffic for patterns

What is the term for the geographical location where the data and processing of an external service provider reside?

• Data centre

• Data jurisdiction

• Data sovereignty

• Data residency

What is one of the procedures that should be followed when an external service provider agreement ends?

• The organisation should delete all data from the external service provider

• The organisation should transfer all data from the external service provider to a new provider or a local storage

• The organisation should pay a termination fee to the external service provider

• The organisation should renew the agreement with the external service provider

What is one of the statutory requirements for dispute resolution between an organisation and an external service provider?

• The organisation and the external service provider should agree on a neutral arbitrator

• The organisation and the external service provider should follow the laws of the country where the data resides

• The organisation and the external service provider should comply with the data protection laws of the organisation's country

• The organisation and the external service provider should settle the dispute in a court of law

What is the difference between confiscation and imaging of devices in desktop forensics?

• Confiscation is the physical seizure of the device, while imaging is the creation of a digital copy of the device

• Confiscation is the removal of the device from the network, while imaging is the capture of the device's screen

• Confiscation is the locking of the device with a password, while imaging is the decryption of the device's data

• Confiscation is the destruction of the device, while imaging is the restoration of the device's data

What is the purpose of reviewing system logs in desktop forensics?

• To identify the user accounts and passwords on the system

• To identify the applications and processes running on the system

• To identify the events and actions that occurred on the system

• To identify the files and folders stored on the system