Incident Response Graded Quiz

 Incident Response Graded Quiz

#cybersecurity #coursera #quiz #solution #network

Select the missing phase of Incident Response: Preparation, _____, Containment, Eradication & Recovery, Post Incident Activity.

1 / 1 point

Execution

Detection and Analysis

Acquire Data

Root Cause Analysis

Correct

Correct!

2.

Question 2

Which statement is true about an incident?

1 / 1 point

An incident becomes an event if a threat is identified.

Incidents involved external actors while events involved internal actors.

An incident is an event that negatively affects IT systems.

An incident is any collection of 3 or more related events.

Correct

Correct!

3.

Question 3

True or False: A Coordinating Incidents Response Team provides advice and guidance to the Distributed IR teams in each department, but generally does not have specific authority over those teams.

1 / 1 point

True

False

Correct

Correct!

4.

Question 4

Which Incident Response Team model describes a team that has authority over all aspects of IR within the entire organization?

1 / 1 point

Central

Control

Coordinating

Distributed

Correct

Correct!

5.

Question 5

In what way will having a set of predefined baseline questions will help you in the event of an incident?

1 / 1 point

Avoid events turning into Incidents.

Interrogate suspects.

Trap the bad actors.

Coordinate with other teams and the media.

Correct

Correct!

6.

Question 6

Incident Response team resources can be divided into which three (3) of the following categories?

1 / 1 point

Incident Analysis Resources

Correct

Partially correct!

Incident Post-Analysis Resources

Incident Analysis Hardware and Software

Correct

Partially correct!

Incident Handler Communications and Facilities

Correct

Partially correct!

7.

Question 7

Port lists, Documentation, and Cryptographic hashes all belong to which Incident Response resource category?

1 / 1 point

Incident Analysis Hardware and Software

Incident Handler Communications and Facilities

Incident Post-Analysis Resources

Incident Analysis Resources

Correct

C​orrect!

8.

Question 8

Which three (3) of the following would be considered an incident detection indicator?

1 / 1 point

Detecting the use of a vulnerability scanner.

An application log showing numerous failed login attempts from an unknown remote system.

Correct

Partially correct!

The discovery of a file containing unusual characters by a system administrator.

Correct

Partially correct!

A significant deviation from typical network traffic flow patterns.

Correct

Partially correct!

9.

Question 9

Which type of monitoring system analyzes logs and events in real time?

1 / 1 point

DLP

IPS

IDS

SIEM

Correct

Correct!

10.

Question 10

True or False: Highly detailed and thorough documentation is needed to support the analysis of current and future incidents.

1 / 1 point

True

False

Correct

Correct!

11.

Question 11

What is the proper classification for a breach that results in sensitive or proprietary information being changed or deleted.

1 / 1 point

None

Privacy Breach

Integrity Loss

Proprietary Breach

Correct

Correct!

12.

Question 12

What is the proper classification for the recovery effort from a breach if sensitive data was stolen and posted on a public web site?

1 / 1 point

Supplemented

Not Recoverable

Extended

Regular

Correct

Correct!

13.

Question 13

During which stage of a comprehensive Containment, Eradication & Recovery strategy does NIST recommend considering the following: Eliminate components of the incident, Disable compromised accounts, and Identify and mitigate vulnerabilities?

1 / 1 point

Containment

Eradication

Recovery

None of these.

Correct

Correct!

14.

Question 14

Which Post Incident activity would include reviewing response times, which systems were impacted and other metrics associated with the incident?

0 / 1 point

Documentation review & update

Evidence retention

Lessons learned meeting

Utilizing collected data

Incorrect

Incorrect. Try reviewing the video Post Incident Activities.