What is a RAID (in the context of disaster recovery)?

A redundant array of independent disks

An incident response team should be ...

fulltime, highly trained people

Dr. Edmon Locard’s exchange principle states that the perpetrator ...

will leave something behind & take something with him

What happens during the escalation phase of an IRP?

Event is analyzed to determine severity, scope, & next steps

If using differential backups, at most how many restores must you perform to restore all data?

two - 1 full backup + 1 differential backup

What is the "chain of custody"? A written record of ...

all who maintained unbroken control of the evidence

Regarding forensics and data collection, what is "order of volatility"?

You should collect most volatile (shortest lived) info first

What is the total time an asset can be out of service before irreparable harm will occur?

Maximum tolerable downtime (MTD)

studbud

SSCP Bootcamp - Incident Response and Recovery

25 termsStudBud Administration1 play

Flashcards25 cardsFPractice quizPHost liveL

Questions 25

Answers

1
What is the time (goal) when functions will be fully restored after an incident?
recovery time objective (RTO)
Maximum tolerable downtime (MTD)
Miminum tolerable downtime (MTD)
recovery point objective (RPO)
2
Which is NOT a type of disaster recovery test?
A simulation test
A full interruption test
A walkthrough test
A desktop test
3
What type of interim processing site is ready to go 'live' immediately after a disaster?
A cold site
A nuclear site
A hot site
A warm site
4
What is a RAID (in the context of disaster recovery)?
A redundant array of independent disks
A bug spray
A repeating array of infosec devices
A sudden attack
5
What type of interim processing site is basically just an empty building with basic utilities?
A hot site
A cold site
A nuclear site
A warm site
6
Forensic tools used to process evidence should be what?
Legally accepted
Sterlized after use in an autoclave
Purchased directly from the vendor
Secured with a chain of custody.
7
An incident response team should be ...
fulltime, highly trained people
remote employees. if possible
mainly administrative staff
recent college graduates or interns
8
Dr. Edmon Locard’s exchange principle states that the perpetrator ...
must exchange credentials w/ admin accounts to be successful
will leave something behind & take something with him
will try to exchange PII data for currency
will be allowed to exchange confidential data reciprocally
9
Which type of backup could require you to restore from more than two backups?
Full
differential
segmential
incremental
10
What happens during the escalation phase of an IRP?
Event is analyzed to determine severity, scope, & next steps
The immediate response to event occurs
Event countermeasures are implemented
A change in state is detected perhaps by use of triggers
11
What is the time when reliable (not necessarily all) data will be restored after an incident?
Maximum tolerable downtime (MTD)
recovery time objective (RTO)
Miminum tolerable downtime (MTD)
recovery point objective (RPO)
12
Evidence should be sealed in _______ bags.
Walmart grocery
Ziploc
Tamper-evident
Tamper-proof
13
If using differential backups, at most how many restores must you perform to restore all data?
one - the 1 differential backup
one - the 1 full backup
two - 1 full backup + 1 differential backup
three - 1 full + 1 differential + 1 incremental
14
Evidence of an incident should always be collected by _____.
a forensic professional
a mortician
a certified medical examiner
Morticia Addams
15
Regarding disaster recovery and backups, the goal is ...
long RTO and short RPO
short RTO and short RPO
equal RTO and RPO
long RTO and short RPO
16
Which is not a type of interim processing site?
A multi-site
A recovery site
A mobile site
A contracted site
17
What is the "chain of custody"? A written record of ...
everyone who transported the evidence
everyone who sealed the tamper-proof bags
all who entered the evidence room where evidence is stored
all who maintained unbroken control of the evidence
18
Once an event is escalated, the response should be __________, if possible, to mitigate damage.
measured
immediate
reproducible
audited
19
Regarding forensics and data collection, what is "order of volatility"?
You should collect info. most valuable to shareholders first
You should collect most volatile (shortest lived) info first
You should collect payroll information first
You should collect most private information first
20
The most used RAID level, uses 3 disks minimum, if 1 disk is lost no data is lost.
Level 0
Level 5
Level 3
Level 1
21
What is the total time an asset can be out of service before irreparable harm will occur?
Miminum tolerable downtime (MTD)
Maximum tolerable downtime (MTD)
recovery point objective (RPO)
recovery time objective (RTO)
22
Regarding emergency response plans, which focuses on restoration of business after an incident?
business continuity plan (BCP)
disaster response plan (DRP)
Recovery time objective (RTO)
Maximum tolerable downtime (MTD)
23
What is an IRP?
An Internet Response Proxy
An Incident Response Plan
An Incident Replacement Plan
An Impossible Replacement Plan
24
As a first responder to an incident, you must make your first priority ...
human safety
evidence collection
documentation of the initial scene upon arrival
scene lockdown upon arrival
25
Which type of backup requires you to restore from only one backup to get all the data restored?
differential
segmential
incremental
Full

SSCP Bootcamp - Incident Response and Recovery Flashcards | StudBud

SSCP Bootcamp - Incident Response and Recovery

25 termsStudBud Administration1 play

SSCP Bootcamp - Incident Response and Recovery

Flashcards25 cardsFPractice quizPHost liveL

Questions 25

Answers

1
What is the time (goal) when functions will be fully restored after an incident?
recovery time objective (RTO)
Maximum tolerable downtime (MTD)
Miminum tolerable downtime (MTD)
recovery point objective (RPO)
2
Which is NOT a type of disaster recovery test?
A simulation test
A full interruption test
A walkthrough test
A desktop test
3
What type of interim processing site is ready to go 'live' immediately after a disaster?
A cold site
A nuclear site
A hot site
A warm site
4
What is a RAID (in the context of disaster recovery)?
A redundant array of independent disks
A bug spray
A repeating array of infosec devices
A sudden attack
5
What type of interim processing site is basically just an empty building with basic utilities?
A hot site
A cold site
A nuclear site
A warm site
6
Forensic tools used to process evidence should be what?
Legally accepted
Sterlized after use in an autoclave
Purchased directly from the vendor
Secured with a chain of custody.
7
An incident response team should be ...
fulltime, highly trained people
remote employees. if possible
mainly administrative staff
recent college graduates or interns
8
Dr. Edmon Locard’s exchange principle states that the perpetrator ...
must exchange credentials w/ admin accounts to be successful
will leave something behind & take something with him
will try to exchange PII data for currency
will be allowed to exchange confidential data reciprocally
9
Which type of backup could require you to restore from more than two backups?
Full
differential
segmential
incremental
10
What happens during the escalation phase of an IRP?
Event is analyzed to determine severity, scope, & next steps
The immediate response to event occurs
Event countermeasures are implemented
A change in state is detected perhaps by use of triggers
11
What is the time when reliable (not necessarily all) data will be restored after an incident?
Maximum tolerable downtime (MTD)
recovery time objective (RTO)
Miminum tolerable downtime (MTD)
recovery point objective (RPO)
12
Evidence should be sealed in _______ bags.
Walmart grocery
Ziploc
Tamper-evident
Tamper-proof
13
If using differential backups, at most how many restores must you perform to restore all data?
one - the 1 differential backup
one - the 1 full backup
two - 1 full backup + 1 differential backup
three - 1 full + 1 differential + 1 incremental
14
Evidence of an incident should always be collected by _____.
a forensic professional
a mortician
a certified medical examiner
Morticia Addams
15
Regarding disaster recovery and backups, the goal is ...
long RTO and short RPO
short RTO and short RPO
equal RTO and RPO
long RTO and short RPO
16
Which is not a type of interim processing site?
A multi-site
A recovery site
A mobile site
A contracted site
17
What is the "chain of custody"? A written record of ...
everyone who transported the evidence
everyone who sealed the tamper-proof bags
all who entered the evidence room where evidence is stored
all who maintained unbroken control of the evidence
18
Once an event is escalated, the response should be __________, if possible, to mitigate damage.
measured
immediate
reproducible
audited
19
Regarding forensics and data collection, what is "order of volatility"?
You should collect info. most valuable to shareholders first
You should collect most volatile (shortest lived) info first
You should collect payroll information first
You should collect most private information first
20
The most used RAID level, uses 3 disks minimum, if 1 disk is lost no data is lost.
Level 0
Level 5
Level 3
Level 1
21
What is the total time an asset can be out of service before irreparable harm will occur?
Miminum tolerable downtime (MTD)
Maximum tolerable downtime (MTD)
recovery point objective (RPO)
recovery time objective (RTO)
22
Regarding emergency response plans, which focuses on restoration of business after an incident?
business continuity plan (BCP)
disaster response plan (DRP)
Recovery time objective (RTO)
Maximum tolerable downtime (MTD)
23
What is an IRP?
An Internet Response Proxy
An Incident Response Plan
An Incident Replacement Plan
An Impossible Replacement Plan
24
As a first responder to an incident, you must make your first priority ...
human safety
evidence collection
documentation of the initial scene upon arrival
scene lockdown upon arrival
25
Which type of backup requires you to restore from only one backup to get all the data restored?
differential
segmential
incremental
Full