Cybersecurity Incident Response Worksheet (Grade 12)

____ is the stage in the cyber kill chain that includes the activation and initiation of the process whereby the crafted exploit gains a foothold and attempts to expand its influence.

• Weaponization

• Exploitation

• Delivery

• Reconnaissance

The job functions and organizational roles of ___ focus on protecting the organization's information systems and stored information from attacks.

• network engineering teams

• information security management and professionals

• physical security personnel

• software development groups

The ___ CSIRT model is used when the organization needs a full-time, on-site CSIRT but does not have enough available, qualified employees.

• centralized

• partially outsourced

• distributed

• virtual

The C.I.A. triad is the industry standard for computer security since the development of the mainframe and is based on three characteristics that describe the utility of information.

• True

• False

A structured walk-through is the CP testing strategy in which the organization conducts a role-playing exercise as if an actual incident or disaster had occurred.

• True

• False

Event correlation involves examining logs from multiple systems and identifying trends or indicators of attacks across those multiple systems.

• True

• False

A series of steps that follow the stages of a cyberattack from early reconnaissance to the exfiltration of data is known as the ___.

• cyber kill chain

• threat matrix

• attack surface

• zero-trust model

____ are procedures for regaining control of systems and restoring operations to normalcy; they are the heart of the IR plan and the CSIRT's operations.

• business continuity policies

• IR reaction strategies

• incident avoidance tactics

• penetration testing methods

The U.S. National Institute of Standards and Technology defines the incident response life cycle as having four main processes: 1) preparation; 2) detection and analysis; 3) containment, eradication, and recovery; and 4) ___.

• post-incident activity

• lessons learned documentation

• risk assessment

• continuous monitoring

____ is used to maintain awareness of evolving threats in general and is a resource for researching specific threats as an organization develops usable threat intelligence.

• open source intelligence

• internal audit reports

• security awareness training

• vulnerability scanning