#cybersecurity #coursera #quiz #solution #network

Incident Response Knowledge Check

Incident Response Knowledge Check

1.

Question 1

Which three (3) of the following are phases of an incident response?

1 / 1 point

Preparation

Correct

Partially correct!

Containment, Eradication & Recovery

Correct

Partially correct!

Post Incident Analysis & Lessons Learned

Detection & Analysis

Correct

Partially correct!

2.

Question 2

Which statement is true about an event?

1 / 1 point

An event may be totally benign, like receiving an email.

Multiple events of the same type are necessary before they can be considered an incident.

An incident can lead to an event if it is determined to be a threat.

An incident is defined as an event that takes place at a specific time and place.

Correct

Correct!

3.

Question 3

True or False: A robust automated incident response system should be able to detect and prevent loss from all incidents.

1 / 1 point

True

False

Correct

Correct!

4.

Question 4

Which three (3) are common Incident Response Team models?

1 / 1 point

Distributed

Correct

Partially correct!

Coordinating

Correct

Partially correct!

Central

Correct

Partially correct!

Control

5.

Question 5

A good automated Incident Response system should be able to detect which three (3) of these common attack vectors?

1 / 1 point

An email phishing attack.

Correct

Partially correct!

A former employee using his knowledge at a competitor company.

An unauthorized removable drive being attached to the network.

Correct

Partially correct!

A brute force hacking attack.

Correct

Partially correct!

6.

Question 6

Which three (3) of the following are components of an Incident Response Policy?

1 / 1 point

IR Policy testing responsibility.

Correct

Partially correct!

Means, tools and resources available.

Correct

Partially correct!

Identity of IR team members.

Correct

Partially correct!

IR Awareness training.

7.

Question 7

Contact information, Smart phones, and Secure storage facilities all belong to which Incident Response resource category?

1 / 1 point

Incident Handler Communications and Facilities.

Incident Post-Analysis Resources.

Incident Analysis Hardware and Software.

Incident Analysis Resources.

Correct

Correct!

8.

Question 8

Which three (3) of the following would be considered an incident detection precursor?

1 / 1 point

Detecting the use of a vulnerability scanner

Correct

Partially correct!

An announced threat against your organization from an activist group.

Correct

Partially correct!

A vendor notice of a vulnerability to a product you own.

Correct

Partially correct!

An application log showing numerous failed login attempts from an unknown remote system.

9.

Question 9

Which type of monitoring system detects anomalous network traffic but typically does not take action beyond sending an alert to an administrator?

1 / 1 point

IDS

IPS

SIEM

DLP

Correct

Correct!

10.

Question 10

True or False: The Incident Response team should keep their documentation as concise as possible so only the most important facts take up the attention of the team leadership.

1 / 1 point

True

False

Correct

Correct!

11.

Question 11

What is the proper classification for a data breach that resulted in the exposure of sensitive personally identifiable information (PII)?

1 / 1 point

None

Integrity Loss

Privacy Breach

Proprietary Breach

Correct

Correct!

12.

Question 12

What is the proper classification for the recovery effort from a breach if you can estimate the total effort required but it will require bringing in additional resources?

1 / 1 point

Not Recoverable

Extended

Supplemented

Regular

Correct

Correct!

13.

Question 13

During which stage of a comprehensive Containment, Eradication & Recovery strategy does NIST recommend considering the following: Potential damange to and theft of resources, Need for evidence preservation, and Service availability?

1 / 1 point

Containment

Eradication

Recovery

None of these

Correct

Correct!

14.

Question 14

Which Post Incident activity would include ascertaining exactly what happened and at what times?

1 / 1 point

Documentation review & update

Lessons learned meeting

Evidence retension

Utilizing collected data

Correct

Correct!