AWR-169-W Cyber Incident Analysis and Response -
module 4
What is the main purpose a. To restore systems to normal operation
of cyber incident recovery?
Restoring systems to a. Recovery
normal operation is the
main purpose of cyber
incident
___________________________
_.
What are the categories of a. User Participation, Automated Detection, Disabling
containment actions? Services, Disabling Connectivity
Which one of the following d. Inactive identification
is NOT a general method
for cyber incident host
identification?
One category of d. Connectivity
containment actions is
disabling__.
, What is the purpose of b. To remove malware or other attack artifacts from systems
cyber incident eradication?
One criterion for b. Remove malware
containment decisions is
the need to _.
The purpose of cyber d. Containment
incident_________________is to
limit damage to systems and
networks.
____is NOT an example of b. Emailing a co-worker for help on an assignment
inappropriate
cyber usage.
Which one of the following b. Reviewing cyber asset lists for new systems placed into
is NOT an activity used in service
cyber incident host
identification?
Besides eradication of c. Adding information gained about this type of attack to the
attack artifacts and knowledge base
restoration of normal
operations, there are
several other activities
that full eradication and
recovery should include;
name one.
WPA/WPA2 should be c. Listening in on wireless networks
used to prevent
attackers from _.
The main containment c. Block traffic from the IP sources
method for Denial of
Service attacks (DoS) is to
______________________if
possible.
What are the priorities for b. Protecting human life, protecting classified and
incident containment, in sensitive data, protecting other data, protecting
order? hardware and software, minimizing disruptions
How to protect against a d. Recovery
module 4
What is the main purpose a. To restore systems to normal operation
of cyber incident recovery?
Restoring systems to a. Recovery
normal operation is the
main purpose of cyber
incident
___________________________
_.
What are the categories of a. User Participation, Automated Detection, Disabling
containment actions? Services, Disabling Connectivity
Which one of the following d. Inactive identification
is NOT a general method
for cyber incident host
identification?
One category of d. Connectivity
containment actions is
disabling__.
, What is the purpose of b. To remove malware or other attack artifacts from systems
cyber incident eradication?
One criterion for b. Remove malware
containment decisions is
the need to _.
The purpose of cyber d. Containment
incident_________________is to
limit damage to systems and
networks.
____is NOT an example of b. Emailing a co-worker for help on an assignment
inappropriate
cyber usage.
Which one of the following b. Reviewing cyber asset lists for new systems placed into
is NOT an activity used in service
cyber incident host
identification?
Besides eradication of c. Adding information gained about this type of attack to the
attack artifacts and knowledge base
restoration of normal
operations, there are
several other activities
that full eradication and
recovery should include;
name one.
WPA/WPA2 should be c. Listening in on wireless networks
used to prevent
attackers from _.
The main containment c. Block traffic from the IP sources
method for Denial of
Service attacks (DoS) is to
______________________if
possible.
What are the priorities for b. Protecting human life, protecting classified and
incident containment, in sensitive data, protecting other data, protecting
order? hardware and software, minimizing disruptions
How to protect against a d. Recovery
