stud
bud
Sign up
Log in
Home
Library
Explore
SAT
More
Duplicate of CDS348 - Ch09 - Part01 Flashcards | StudBud
Explore
/
Duplicate of CDS348 - Ch09 - Part01
Duplicate of CDS348 - Ch09 - Part01
30 terms
·
StudBud Administration
·
17 plays
Imported from external platform
Flashcards
30 cards
F
Practice quiz
P
Host live
L
Questions
30
Answers
1
What is a common misconception about the Incident Response (IR) process?
It only involves simple data backup and recovery
It focuses primarily on legal action
It only applies to government agencies
It does not require a trained team
2
Why is it important to regularly test backups?
To prevent employees from accessing old data
To make recovery take longer
To ensure they work before they are critically needed
To increase storage space
3
Why are after-action review meetings important in incident response?
They help analyze what worked and what needs improvement
They prevent future incidents from occurring
They ensure customers are informed about the attack
They allow employees to take a break from cybersecurity tasks
4
What is the primary purpose of an After-Action Review (AAR)?
To formally bring the IR team's actions to a close
To restore lost data
To assign blame for the incident
To prevent future cyberattacks
5
Why is continuous training important for staff involved in IR?
To make sure they always report incidents to the media
To allow them to work without supervision
To keep them updated on response protocols and improve effectiveness
To reduce the number of security incidents permanently
6
Which of the following is an outcome of an AAR?
Reporting the incident to all employees
Creating a revised IR plan
Conducting another incident response test immediately
Restarting the containment phase
7
What is included in the periodic review of an IR plan?
Removing old incident records
Comprehensive evaluation and necessary updates
Increasing the number of IT employees
Reducing cybersecurity measures
8
What is the purpose of cross-training in an IR plan?
To make sure multiple staff members can respond to incidents
To test employees on their knowledge of security threats
To reduce the workload of cybersecurity teams
To increase teamwork within the IT department
9
Why must compromised services be verified before restoration?
To ensure they are not still vulnerable
To permanently remove affected servers
To allow employees to work remotely
To report to the media about the attack
10
What is the purpose of an “incident impact assessment”?
Identify the attacker
Restore internet access
Determine overall cost and damage of the incident
Notify stakeholders
11
What is an essential part of reviewing an IR plan?
Hiring new security staff
Discarding old incident reports
Only responding to known threats
Testing response strategies through rehearsals
12
What is the purpose of forensic data analysis in incident response?
To create new security policies
To alert the media about the attack
To replace all company computers
To analyze how an incident occurred and what vulnerabilities were exploited
13
What does opportunity cost refer to in loss analysis?
Cost of training employees
Paying for software updates
Time lost that could have been spent on more productive tasks
Cost of third-party vendors
14
Why is an organization especially vulnerable after an incident?
The organization has to hire new staff
The network speed is reduced
Employees may be afraid to use the system
Attackers may attempt to exploit weak recovery processes
15
What must organizations ensure before declaring full recovery?
That no residual effects from the incident remain
That the attacker has been identified
That all employees have changed their passwords
That all affected systems have been replaced
16
Why is digital forensics important in cybersecurity investigations?
It helps identify security vulnerabilities and preserve evidence
It speeds up network performance
It prevents all future attacks
It eliminates the need for backups
17
What should organizations focus on during IR plan maintenance?
Keeping the plan confidential from employees
Reducing security measures to save costs
Ensuring the plan aligns with evolving threats
Updating contact information only
18
Why is investigating the spread of an attack important?
To estimate the cost of replacing hardware
To determine the best way to punish attackers
To identify vulnerabilities and prevent future incidents
To alert law enforcement agencies
19
What actions should an organization take to prevent future incidents?
Ignore security alerts
Increase employee salaries
Replace, install, or upgrade security safeguards
Reduce the number of security staff
20
What is the first step in incident recovery?
Notifying customers about the breach
Restoring data backups
Conducting an incident damage assessment
Shutting down all IT systems
21
What must individuals handling forensic evidence ensure?
That all collected data is erased after the investigation
That only IT staff can access the evidence
That evidence is stored securely and legally admissible
That evidence is shared publicly for transparency
22
Which of the following is a cost considered in incident loss analysis?
Cost of new hires
Cost of person-hours diverted from normal operations
Cost of marketing
Cost of office supplies
23
True or False – Damages from incidents rarely exceed $10,000.
True
False
24
What must the IR team understand before restoring data?
The number of affected customers
The financial cost of the incident
The organization's backup strategy
Employee attendance records
25
Why is it important to ensure no residual effects remain after an attack?
To comply with cybersecurity insurance policies
To prevent further damage and future security incidents
To avoid unnecessary upgrades to security systems
To maintain the organization’s reputation
26
What is one key benefit of rehearsals?
They guarantee incident prevention
They replace formal training programs
They reduce the need for cybersecurity policies
Identification of shortcomings & provide opportunities for improvement
27
Why is evaluating monitoring capabilities important after an incident?
To reduce network traffic
To ensure detection and reporting methods are effective
To comply with insurance policies
To eliminate the need for cybersecurity training
28
Why might organizations be legally required to notify stakeholders after an incident?
To hide evidence of the breach
To prevent employees from using company networks
To increase their cybersecurity budget
Due to industry regulations requiring transparency
29
What is the primary goal of data recovery procedures?
To upgrade all security software
To prevent employees from accessing compromised data
To restore systems from backups to usable condition
To delete all affected files
30
Why must an organization undertake training programs for incident response (IR)?
To ensure a sufficient pool of qualified staff members
To improve employee morale
To prepare for audits
To fulfill annual compliance requirements
