1. To ensure a secure computing environment, investigate each reported event.

1. True

2. False

  2. Many incidents go unreported because they are never recognized.

1. True

2. False

  3. Which of the following is the best description of the CSIRT’s initial responsibility for incidents?

1. Recognize incidents.

2. Validate that an incident has occurred.

3. Initiate the incident investigation.

4. Contain the incident damage.

  4. The ________ step of handling incidents should always occur before an incident happens.

  5. Which incident-handling step might include disconnecting a computer from the network?

1. Identification

2. Eradication

3. Containment

4. Recovery

  6. The ________ step to handling incidents is the most important step to continuously improving your incident response plan.

  7. IT investigators (SMEs) are all CSIRT team members.

1. True

2. False

  8. Which incident classification would apply to a situation where you find that your user account is locked due to too many logon tries using an incorrect password?

1. Unauthorized access of a limited account

2. AUP violation

3. Failed attempt to access any account

4. Unauthorized scan of one or more systems

  9. Which incident security level would be appropriate after discovering that several of your workstations are infected with worms that will launch a coordinated DoS attack against your web servers in 12 hours?

1. Severe

2. High

3. Moderate

4. Low

10. Which incident-handling step might include scanning a computer for malware?

1. Identification

2. Containment

3. Eradication

4. Recovery

11. Which incident-handling step might include removing a virus from a computer?

1. Identification

2. Containment

3. Eradication

4. Recovery

12. The contents of log files are which type of evidence?

1. Real evidence

2. Documentary evidence

3. Testimonial evidence

4. Demonstrative evidence

13. The documentation that provides details of every move and access of evidence is called the ________.

14. You should treat every incident as if it might end up in court.

1. True

2. False

15. Any small change to evidence data may render that evidence unusable to your case.

1. True

2. False