Mod 13 Incident Preparation and Investigation

A company has been involved in a three-month project to ensure they do not suffer downtime due to threats that could hamper their operations. They are now ready to test some of the elements in the project. Which of the following most likely represents what the company is doing?

• They are implementing mission-essential backup functions to ensure high availability.

• They are implementing and testing systems that provide redundancy.

• They are in the process of developing a BCP.

• They are verifying their hot site availability.

Answer explanation

The company is developing a Business Continuity Plan (BCP) to ensure operations can continue during disruptions. Testing elements of the project aligns with BCP development, making this the most appropriate choice.

Three members of a larger task force at an enterprise are responsible for ensuring a variety of technologies, diverse vendors, and encryption capabilities are part of the company's networking infrastructure. Which of the following is most likely to be a true statement regarding their activities?

• This is part of a plan to ensure their operations are not disrupted if a major disaster occurs.

• To ensure their infrastructure is scalable and able to meet growth demands of the future.

• They are locking down their network to make it more difficult for threat actors to break in.

• They are exploring different cloud technology options that encompass the stated requirements.

Answer explanation

The correct choice highlights that the task force's activities are aimed at disaster recovery, ensuring operations remain uninterrupted during major incidents by integrating diverse technologies and encryption.

Which of the following events could hamper a mission-essential function? Select two.

• The antenna used to broadcast a rocket ship launch on TV takes a tumble.

• An attacker compromises the email server at an academic institution.

• The reservation system for an airline is affected by ransomware.

• A cyberattack on a SCADA system shuts down a water treatment plant.

• The tracking system for a package delivery company experiences a failover event.

Answer explanation

The ransomware affecting the airline's reservation system and the cyberattack on the SCADA system disrupting the water treatment plant are critical events that can severely impact mission-essential functions.

A data center suffered damage due to a natural disaster. The IT staff is in the process of restoring service, but they need to follow a specific series of steps due to critical dependencies. The content of which document are they most likely to follow?

• BIA

• BCP

• DRP

• COOP

Answer explanation

The IT staff will follow the Disaster Recovery Plan (DRP) to restore services after a natural disaster, as it outlines the specific steps and dependencies necessary for recovery.

In the process of responding to a security event, Fram identifies the cause of the event and temporarily disconnects the system that may be causing damage from the network. What action did Fram take in terms of response?

• Containment

• Eradication

• Quarantine

• Isolation

Answer explanation

Fram's action of disconnecting the system from the network to prevent further damage is best described as 'Containment'. 'Eradication' refers to removing the threat entirely, which is not what was done here.

An organization suffers what appears to be a security breach. However, upon further analysis, they quickly determine it is not a significant event and no further action is taken. Which of the following most likely allowed them to make this determination?

• Incident classification

• Triage process

• Security monitoring tools

• Incident response plan

Answer explanation

Incident classification and the triage process allowed the organization to assess the severity of the security breach quickly, determining it was not significant and requiring no further action.

What should an incident response plan provide?

• The lessons learned documented from previous incidents.

• The collective experience of the incident response team.

• The definitions spelled out in the incident response plan.

• Their ability to contain the threat quickly and automatically.

Answer explanation

An incident response plan should clearly define roles, procedures, and responsibilities. This ensures that all team members understand their tasks during an incident, making the definitions in the plan crucial for effective response.

Givon, a skilled technician with extensive knowledge of a company's network, is reviewing a recovery procedure in detail. What is the most likely reason why Givon is doing this?

• He is walking through a testing exercise to see if there are any errors or false assumptions.

• He is walking through a testing exercise to confirm failover processes are fully spelled out.

• He is walking through a testing exercise to confirm the specified simulation will be successful.

• He is walking through a testing exercise just before he physically implements it to prevent issues.

• He is walking through a testing exercise to confirm there are no omissions or gaps.

Answer explanation

Givon is reviewing the recovery procedure to identify any errors or false assumptions, as well as to ensure there are no omissions or gaps. This thorough review is crucial for a successful recovery process.

A company has a central office and two satellite branches. The security team simultaneously renders the DNS servers at the three satellite sites inoperable. The goal is to test how effective the same incident response will be at the branch sites. Which term best describes this exercise?

• Denial of Service simulation

• Failover simulation

• Multi kill chain

• Parallel processing

Answer explanation

The exercise tests the incident response effectiveness at multiple sites simultaneously, which is best described as 'Parallel processing'. This term indicates that the same action is being executed concurrently across different locations.

An organization is researching a series of documents that spell out the process that should be used to define policies and procedures that relate to security. What is the organization most likely trying to accomplish?

• They want to adopt a security framework.

• They are getting ready for a security audit.

• They failed an audit and are addressing deficiencies.

• They want government contracts but need to comply with certain security requirements.

Answer explanation

The organization is likely looking to adopt a security framework, as they are researching documents that outline processes for defining security policies and procedures, which is a key step in establishing such a framework.