Cyber Threat Management (Check Point Exam #2)

Which type of data would be considered an example of volatile data?

• temp files

• web browser cache

• memory registers

• log files

Keeping data backups offsite is an example of which type of disaster recovery control?

• preventive

• corrective

• detective

• management

Which NIST-defined incident response stakeholder is responsible for coordinating incident response with other stakeholders and minimizing the damage of an incident?

• management

• IT support

• the legal department

• human resources

What type of exercise interrupts services to verify that all aspects of a business continuity plan are able to respond to a certain type of incident?

• Tabletop exercise

• Functional test

• Operational exercise

Match the intrusion event defined in the Diamond Model of intrusion to the description.

• victim

• the target of the attack

• capability

• the parties responsible for the intrusion

• adversary

• network path used to establish and maintain command and control

• infrastructure

• a tool or technique used to attack the victim

What is a chain of custody?

• the disciplinary measures an organization may perform if an incident is caused by an employee

• the documentation surrounding the preservation of evidence related to an incident

• a plan ensuring that each party involved in an incident response understands how to collect evidence

• a list of all of the stakeholders that were exploited by an attacker

According to the Cyber Kill Chain model, after a weapon is delivered to a targeted system, what is the next step that a threat actor would take?

• installation

• action on objectives

• exploitation

• weaponization

In which step of the NIST incident response process does the CSIRT perform an analysis to determine which networks, systems, or applications are affected; who or what originated the incident; and how the incident is occurring?

• detection

• attacker identification

• scoping

• incident notification

Which task describes threat attribution?

• obtaining the most volatile evidence

• reporting the incident to the proper authorities

• evaluating the server alert data

• determining who is responsible for the attack

Place the seven steps defined in the Cyber Kill Chain in the correct order.

• exploitation

• step 3

• delivery

• step 1

• reconnaissance

• step 5

• installation

• step 2

• weaponization

• step 4