TestOut PC Pro - 14.2 Incident Response and Regulated Data

As part of the response to a security incident on your company network, you have been asked to draft a document related to evidence gathering that contains details about personnel in possession and control of evidence from the time of discovery up to the time of presentation in court. Which document have been asked to draft?

• CPS (Certificate Practice Statement)

• FIPS-140

• Chain of custody

• Rules of evidence

You work for a company that offers their services through the internet. It is critical that your website performs well. As a member of the IT technician staff, you receive a call from a fellow employee who informs you that customers are complaining that they can't access your website. After doing a little research, you have determined that you are a victim of a denial-of-service attack. As a first responder, which of the following is the next step you need to perform in response to the security incident?

• Identify the issue further.

• Secure the affected system.

• Investigate how the attack occurred.

• Eradicate the issue.

A security incident is currently occurring on your company's network. You discover that the attack involves a computer system that is attached to the network. You are unsure what kind of damage is being done to the network systems or data. Which of the following actions should you take FIRST?

• Stop the attack and contain the damage by disconnecting the system from the network.

• Document and photograph the entire crime scene, including the current state of the attached computer system.

• Determine whether you have the expertise to conduct an investigation or whether you need to call in additional help.

• Examine the active computer system to analyze the live network connection, memory contents, and running programs.

Which of the following is an important aspect of evidence gathering in response to a security incident?

• Purge transaction logs.

• Monitor user access to compromised systems.

• Restore damaged data from backup media.

• Back up all log files and audit trails.

A security technician is conducting a forensic analysis. Which of the following actions is MOST likely to destroy critical evidence?

• Copying the contents of memory to removable media

• Disconnecting the system from the network

• Shutting down the system

• Restricting physical access to the system

A technician was able to stop a security attack on a user's computer. Which of the following actions should be performed FIRST when conducting the subsequent forensic investigation?

• Document what is on the screen.

• Stop all running processes.

• Turn off the system.

• Remove the hard drive.

As the principal of a private school, you have discovered that an office assistant has shared a student's home address with an unauthorized individual. Which of the following regulations is your school in violation of?

• SOX

• HIPAA

• CCPA

• FERPA

You have accepted a position working in a local hospital's IT department. Which of the following government regulations would be the most important for the hospital to be in compliance with?

• PCI DSS

• GDPR

• HIPAA

• FERPA

Which of the following is an example of personal, government-issued information?

• Healthcare records

• Student records

• Credit score

• Social security number

Match each incident detection method with the appropriate description.

• Active

• A technician performing maintenance on a computer discovers prohibited content.

• Proactive

• A network intrusion detection system (IDS) detects malicious traffic.

• Passive

• A device or practice helps determine how and why a security incident occurred.

• Passive

• An organization looks for existing security flaws in their system.