AWR-169-W Cyber Incident Analysis and Response -
module 1
a. Preventative measures are based upon risk analysis of past events.
Why are preventative b. Some types of attacks cannot be prevented.
measures alone insufficient for c. New types of attacks are constantly
effective cybersecurity? being developed. correct - d. All of the
above
Which attack is considered as a advanced persistent threat
highly- structured or complex
attack?
What is the difference b. A cybersecurity incident is a cyber event attributable to a human
between a cybersecurity cause.
event and a cybersecurity
incident?
NIST SP 800-61 describes Cybersecurity incidents
what organizations should
do in regard to the effective
handling of________.
During the protection phase a. Detection of events
of cybersecurity incident
management, one of the key
, activities is:
One of the key activities b. Detection of events
during the protection phase of
cybersecurity incident
management is:
Which one of the following Declassifying evidence as quickly as possible
is NOT a benefit to cyber
security incident
management?
Which one of the following is a. Policy creation
part of the preparation phase
of cyber incident
management?
module 1
a. Preventative measures are based upon risk analysis of past events.
Why are preventative b. Some types of attacks cannot be prevented.
measures alone insufficient for c. New types of attacks are constantly
effective cybersecurity? being developed. correct - d. All of the
above
Which attack is considered as a advanced persistent threat
highly- structured or complex
attack?
What is the difference b. A cybersecurity incident is a cyber event attributable to a human
between a cybersecurity cause.
event and a cybersecurity
incident?
NIST SP 800-61 describes Cybersecurity incidents
what organizations should
do in regard to the effective
handling of________.
During the protection phase a. Detection of events
of cybersecurity incident
management, one of the key
, activities is:
One of the key activities b. Detection of events
during the protection phase of
cybersecurity incident
management is:
Which one of the following Declassifying evidence as quickly as possible
is NOT a benefit to cyber
security incident
management?
Which one of the following is a. Policy creation
part of the preparation phase
of cyber incident
management?
