🌍 All Study Guides 📊 Dashboard 📰 Blog 💡 About

IBM Cybersecurity Analyst Professional Certificate • STUDY MODE

PRACTICE QUIZ

QUESTION 1 OF 30

Which three (3) of the following are phases of an incident response?

Containment, Eradication & RecoveryCorrect Answer

Post Incident Analysis & Lessons Learned

PreparationCorrect Answer

Detection & AnalysisCorrect Answer

QUESTION 2 OF 30

Which statement is true about an event?

An incident is defined as an event that takes place at a specific time and place.

An incident can lead to an event if it is determined to be a threat.

Multiple events of the same type are necessary before they can be considered an incident.

An event may be totally benign, like receiving an email.Correct Answer

QUESTION 3 OF 30

True or False: A robust automated incident response system should be able to detect and prevent loss from all incidents.

True

FalseCorrect Answer

QUESTION 4 OF 30

Which three (3) are common Incident Response Team models?

DistributedCorrect Answer

CoordinatingCorrect Answer

CentralCorrect Answer

Control

QUESTION 5 OF 30

A good automated Incident Response system should be able to detect which three (3) of these common attack vectors?

An unauthorized removable drive being attached to the network.Correct Answer

A brute force hacking attack.Correct Answer

A former employee using his knowledge at a competitor company.

An email phishing attack.Correct Answer

QUESTION 6 OF 30

Which three (3) of the following are components of an Incident Response Policy?

IR Policy testing responsibility.Correct Answer

IR Awareness training.

Means, tools and resources available.Correct Answer

Identity of IR team members.Correct Answer

QUESTION 7 OF 30

Contact information, Smart phones, and Secure storage facilities all belong to which Incident Response resource category?

Incident Handler Communications and Facilities.Correct Answer

Incident Analysis Resources.

Incident Post-Analysis Resources.

Incident Analysis Hardware and Software.

QUESTION 8 OF 30

Which three (3) of the following would be considered an incident detection precursor?

Detecting the use of a vulnerability scannerCorrect Answer

An announced threat against your organization from an activist group.Correct Answer

An application log showing numerous failed login attempts from an unknown remote system.

A vendor notice of a vulnerability to a product you own.Correct Answer

QUESTION 9 OF 30

Which type of monitoring system detects anomalous network traffic but typically does not take action beyond sending an alert to an administrator?

IPS

IDSCorrect Answer

DLP

SIEM

QUESTION 10 OF 30

True or False: The Incident Response team should keep their documentation as concise as possible so only the most important facts take up the attention of the team leadership.

True

FalseCorrect Answer

QUESTION 11 OF 30

What is the proper classification for a data breach that resulted in the exposure of sensitive personally identifiable information (PII)?

None

Privacy BreachCorrect Answer

Proprietary Breach

Integrity Loss

QUESTION 12 OF 30

What is the proper classification for the recovery effort from a breach if you can estimate the total effort required but it will require bringing in additional resources?

Regular

Extended

SupplementedCorrect Answer

Not Recoverable

QUESTION 13 OF 30

During which stage of a comprehensive Containment, Eradication & Recovery strategy does NIST recommend considering the following: Potential damange to and theft of resources, Need for evidence preservation, and Service availability?

ContainmentCorrect Answer

Eradication

Recovery

None of these

QUESTION 14 OF 30

Which Post Incident activity would include ascertaining exactly what happened and at what times? INCIDENT RESPONSE GRADED QUIZ

Utilizing collected data

Evidence retension

Lessons learned meetingCorrect Answer

Documentation review & update

QUESTION 15 OF 30

Select the missing phase of Incident Response: Preparation, _____, Containment, Eradication & Recovery, Post Incident Activity.

Detection and AnalysisCorrect Answer

Execution

Root Cause Analysis

Acquire Data

QUESTION 16 OF 30

Which statement is true about an incident?

An incident is an event that negatively affects IT systems.Correct Answer

An incident is any collection of 3 or more related events.

Incidents involved external actors while events involved internal actors.

An incident becomes an event if a threat is identified.

QUESTION 17 OF 30

True or False: A Coordinating Incidents Response Team provides advice and guidance to the Distributed IR teams in each department, but generally does not have specific authority over those teams.

TrueCorrect Answer

False

QUESTION 18 OF 30

Which Incident Response Team model describes a team that has authority over all aspects of IR within the entire organization?

Distributed

Coordinating

CentralCorrect Answer

Control

QUESTION 19 OF 30

In what way will having a set of predefined baseline questions will help you in the event of an incident?

Trap the bad actors.

Interrogate suspects.

Coordinate with other teams and the media.Correct Answer

Avoid events turning into Incidents.

QUESTION 20 OF 30

Incident Response team resources can be divided into which three (3) of the following categories?

Incident Analysis ResourcesCorrect Answer

Incident Handler Communications and FacilitiesCorrect Answer

Incident Post-Analysis Resources

Incident Analysis Hardware and SoftwareCorrect Answer

QUESTION 21 OF 30

Port lists, Documentation, and Cryptographic hashes all belong to which Incident Response resource category?

Incident Post-Analysis Resources

Incident Analysis ResourcesCorrect Answer

Incident Analysis Hardware and Software

Incident Handler Communications and Facilities

QUESTION 22 OF 30

Which three (3) of the following would be considered an incident detection indicator?

Detecting the use of a vulnerability scanner.

An application log showing numerous failed login attempts from an unknown remote system.Correct Answer

A significant deviation from typical network traffic flow patterns.Correct Answer

The discovery of a file containing unusual characters by a system administrator.Correct Answer

QUESTION 23 OF 30

Which type of monitoring system analyzes logs and events in real time?

IPS

IDS

DLP

SIEMCorrect Answer

QUESTION 24 OF 30

True or False: Highly detailed and thorough documentation is needed to support the analysis of current and future incidents.

TrueCorrect Answer

False

QUESTION 25 OF 30

What is the proper classification for a breach that results in sensitive or proprietary information being changed or deleted.

Proprietary Breach

Privacy Breach

Integrity LossCorrect Answer

None

QUESTION 26 OF 30

What is the proper classification for the recovery effort from a breach if sensitive data was stolen and posted on a public web site?

Not RecoverableCorrect Answer

Supplemented

Regular

Extended

QUESTION 27 OF 30

During which stage of a comprehensive Containment, Eradication & Recovery strategy does NIST recommend considering the following: Eliminate components of the incident, Disable compromised accounts, and Identify and mitigate vulnerabilities?

Containment

EradicationCorrect Answer

Recovery

None of these.

QUESTION 28 OF 30

Which Post Incident activity would include reviewing response times, which systems were impacted and other metrics associated with the incident?

Lessons learned meeting

Evidence retention

Documentation review & update

Utilizing collected dataCorrect Answer

QUESTION 29 OF 30

During which stage of a comprehensive Containment, Eradication & Recovery strategy does NIST recommend considering the following: Potential damange to and theft of resources, Need for evidence preservation, and Service availability?

ContainmentCorrect Answer

Eradication

Recovery

None of these

QUESTION 30 OF 30

Which Post Incident activity would include ascertaining exactly what happened and at what times?

Utilizing collected data

Evidence retension 

Lessons learned meetingCorrect Answer

Documentation review & update

Ready to test your recall?

Which three (3) of the following are phases of an incident response?

💡Select all 3 correct answers before submitting (0 of 3 selected).

Containment, Eradication & Recovery

Post Incident Analysis & Lessons Learned

Preparation

Detection & Analysis

How confident are you in this answer?

PRACTICE QUIZ

Which three (3) of the following are phases of an incident response?

Which statement is true about an event?

True or False: A robust automated incident response system should be able to detect and prevent loss from all incidents.

Which three (3) are common Incident Response Team models?

A good automated Incident Response system should be able to detect which three (3) of these common attack vectors?

Which three (3) of the following are components of an Incident Response Policy?

Contact information, Smart phones, and Secure storage facilities all belong to which Incident Response resource category?

Which three (3) of the following would be considered an incident detection precursor?

Which type of monitoring system detects anomalous network traffic but typically does not take action beyond sending an alert to an administrator?

True or False: The Incident Response team should keep their documentation as concise as possible so only the most important facts take up the attention of the team leadership.

What is the proper classification for a data breach that resulted in the exposure of sensitive personally identifiable information (PII)?

What is the proper classification for the recovery effort from a breach if you can estimate the total effort required but it will require bringing in additional resources?

During which stage of a comprehensive Containment, Eradication & Recovery strategy does NIST recommend considering the following: Potential damange to and theft of resources, Need for evidence preservation, and Service availability?

Which Post Incident activity would include ascertaining exactly what happened and at what times? INCIDENT RESPONSE GRADED QUIZ

Select the missing phase of Incident Response: Preparation, _____, Containment, Eradication & Recovery, Post Incident Activity.

Which statement is true about an incident?

True or False: A Coordinating Incidents Response Team provides advice and guidance to the Distributed IR teams in each department, but generally does not have specific authority over those teams.

Which Incident Response Team model describes a team that has authority over all aspects of IR within the entire organization?

In what way will having a set of predefined baseline questions will help you in the event of an incident?

Incident Response team resources can be divided into which three (3) of the following categories?

Port lists, Documentation, and Cryptographic hashes all belong to which Incident Response resource category?

Which three (3) of the following would be considered an incident detection indicator?

Which type of monitoring system analyzes logs and events in real time?

True or False: Highly detailed and thorough documentation is needed to support the analysis of current and future incidents.

What is the proper classification for a breach that results in sensitive or proprietary information being changed or deleted.

What is the proper classification for the recovery effort from a breach if sensitive data was stolen and posted on a public web site?

During which stage of a comprehensive Containment, Eradication & Recovery strategy does NIST recommend considering the following: Eliminate components of the incident, Disable compromised accounts, and Identify and mitigate vulnerabilities?

Which Post Incident activity would include reviewing response times, which systems were impacted and other metrics associated with the incident?

During which stage of a comprehensive Containment, Eradication &amp; Recovery strategy does NIST recommend considering the following: Potential damange to and theft of resources, Need for evidence preservation, and Service availability?

Which Post Incident activity would include ascertaining exactly what happened and at what times?

Ready to test your recall?

During which stage of a comprehensive Containment, Eradication & Recovery strategy does NIST recommend considering the following: Potential damange to and theft of resources, Need for evidence preservation, and Service availability?