CSF 3103 - MCQ - CLO3

A CSIRT model in which a single CSIRT handles incidents throughout the organization is called a(n) ____

A CSIRT model that is effective for large organizations and for organizations with major computing resources at distant locations is the ____.

The _____ CSIRT model is used when the organization needs a full-time, on-site CSIRT but does not have enough available, qualified employees.

Organizations with limited funding, staffing, or IR needs may have only _____ IR team members

The CSIRT must have a clear and concise ____ statement that, in a few sentences, unambiguously articulates what it will do.

A key step in the ____ approach to incident response is to discover the identity of the intruder while documenting their activity.

The first group or person to communicate the CSIRT’s vision and operational plan is the managerial team or individual serving as the ____

During the AAR, all team members primarily _____.

A feedback mechanism that can be used to measure the effectiveness of a CSIRT is the ____

While a security operations center is designed to _____, a CSIRT focuses on _____

A centralized facility where the organization’s security efforts and technologies are monitored by dedicated technicians is known as the _____.

An example of a _____ indicator is if a business partner or another connected organization reports an attack from your computing systems.

The CSIRT may not wish to “tip off” attackers that they have been detected, especially if the organization is following a(n) ____ approach.

A ____ attack is much more substantial than a DoS attack because of the use of multiple systems to simultaneously attack a single target.

According to NIST, which of the following is an example of an unauthorized access attack?

The CSIRT must document and preserve every action, file, event, and _____.

______ is used both for intrusion analysis and as part of evidence collection and analysis.

The objective of an incident resolution announcement is to prevent _____ from causing additional disruption to the operations of the organization.

Which of these is NOT a question that might be useful in a periodic review of the IR plan?