0 [{"id":62544,"quiz_id":"4841","answer_id":null,"answerType_id":"2","created_at":"2016-05-05 04:53:22","updated_at":"2016-05-05 04:53:22","questionName":"Post-Incident phase if IR process","questionTimeSeconds":"0","questionTimeMinutes":"2","questionImagePath":null,"position":null,"explanation":"","question_score_id":null,"lang":null,"questionAudioPath":null},{"id":62542,"quiz_id":"4841","answer_id":null,"answerType_id":"0","created_at":"2016-05-05 04:30:35","updated_at":"2016-05-05 04:30:35","questionName":"Who writes an incident response plan?","questionTimeSeconds":"0","questionTimeMinutes":"2","questionImagePath":null,"position":null,"explanation":"","question_score_id":null,"lang":null,"questionAudioPath":null},{"id":62543,"quiz_id":"4841","answer_id":null,"answerType_id":"2","created_at":"2016-05-05 04:49:30","updated_at":"2016-05-05 04:49:30","questionName":"Match the definition of the IR process with the name","questionTimeSeconds":"30","questionTimeMinutes":"0","questionImagePath":null,"position":null,"explanation":"","question_score_id":null,"lang":null,"questionAudioPath":null},{"id":62551,"quiz_id":"4841","answer_id":null,"answerType_id":"2","created_at":"2016-05-05 05:24:17","updated_at":"2016-05-05 05:24:17","questionName":"Match the following definitions","questionTimeSeconds":"0","questionTimeMinutes":"2","questionImagePath":null,"position":null,"explanation":"","question_score_id":null,"lang":null,"questionAudioPath":null},{"id":62538,"quiz_id":"4841","answer_id":null,"answerType_id":"3","created_at":"2016-05-05 04:10:29","updated_at":"2016-05-05 04:10:29","questionName":"Put these IR process phases in order from 1 - 4","questionTimeSeconds":"0","questionTimeMinutes":"1","questionImagePath":null,"position":null,"explanation":"Loop between 2 & 3 and link from 4 - 1","question_score_id":null,"lang":null,"questionAudioPath":null},{"id":62546,"quiz_id":"4841","answer_id":null,"answerType_id":"3","created_at":"2016-05-05 05:03:25","updated_at":"2016-05-05 05:03:25","questionName":"Put the following core stages of the detection and analysis phase (forensic investigation) in order from start to finish = Collect Preserves @ Pats","questionTimeSeconds":"0","questionTimeMinutes":"2","questionImagePath":"uploads\/ihw-os-sem-2\/Picture1.png","position":null,"explanation":"","question_score_id":null,"lang":null,"questionAudioPath":null},{"id":62549,"quiz_id":"4841","answer_id":null,"answerType_id":"2","created_at":"2016-05-05 05:13:13","updated_at":"2016-05-05 05:13:13","questionName":"The CMA states","questionTimeSeconds":"0","questionTimeMinutes":"2","questionImagePath":null,"position":null,"explanation":"","question_score_id":null,"lang":null,"questionAudioPath":null},{"id":62548,"quiz_id":"4841","answer_id":null,"answerType_id":"0","created_at":"2016-05-05 05:07:39","updated_at":"2016-05-05 05:07:39","questionName":"What does the preparation phase of the IR process entail?","questionTimeSeconds":"0","questionTimeMinutes":"2","questionImagePath":null,"position":null,"explanation":"","question_score_id":null,"lang":null,"questionAudioPath":null},{"id":62545,"quiz_id":"4841","answer_id":null,"answerType_id":"0","created_at":"2016-05-05 04:55:52","updated_at":"2016-05-05 04:55:52","questionName":"Some benefits of having an IR programme in organisations are","questionTimeSeconds":"0","questionTimeMinutes":"2","questionImagePath":null,"position":null,"explanation":"","question_score_id":null,"lang":null,"questionAudioPath":null},{"id":62547,"quiz_id":"4841","answer_id":null,"answerType_id":"0","created_at":"2016-05-05 05:05:14","updated_at":"2016-05-05 05:06:57","questionName":"For each item of desirable\/potential evidence, an organisation has to evaluate and IR procedures need to reflect answers to questions such as:","questionTimeSeconds":"0","questionTimeMinutes":"2","questionImagePath":null,"position":null,"explanation":"","question_score_id":null,"lang":null,"questionAudioPath":null},{"id":62540,"quiz_id":"4841","answer_id":null,"answerType_id":"1","created_at":"2016-05-05 04:24:01","updated_at":"2016-05-05 04:24:01","questionName":"There is a LOOP between the Detection and Analysis phase and the Containment Eradication and Recovery Phase of the IR Process","questionTimeSeconds":"0","questionTimeMinutes":"2","questionImagePath":null,"position":null,"explanation":"","question_score_id":null,"lang":null,"questionAudioPath":null},{"id":62539,"quiz_id":"4841","answer_id":null,"answerType_id":"1","created_at":"2016-05-05 04:13:30","updated_at":"2016-05-05 04:32:33","questionName":"The purpose of an IR plan is that it provides details for implementing _____________________","questionTimeSeconds":"0","questionTimeMinutes":"1","questionImagePath":null,"position":null,"explanation":"","question_score_id":null,"lang":null,"questionAudioPath":null},{"id":62550,"quiz_id":"4841","answer_id":null,"answerType_id":"2","created_at":"2016-05-05 05:15:36","updated_at":"2016-05-05 05:15:36","questionName":"Match the following in relation to Incident Response","questionTimeSeconds":"0","questionTimeMinutes":"2","questionImagePath":null,"position":null,"explanation":"","question_score_id":null,"lang":null,"questionAudioPath":null},{"id":62541,"quiz_id":"4841","answer_id":null,"answerType_id":"1","created_at":"2016-05-05 04:26:21","updated_at":"2016-05-05 04:26:21","questionName":"There is a link from the Post-Incident Activity phase to the Preparation phase of the IR process","questionTimeSeconds":"0","questionTimeMinutes":"1","questionImagePath":null,"position":null,"explanation":"","question_score_id":null,"lang":null,"questionAudioPath":null}]

block

Post-Incident phase if IR process

Cocokkan teks (klik dan seret)   

(0/0)

Periksa Order Of Answers

---

Cocokkan teks
involves collection of
involves collection/analysis of
involves retention of

Klik dan seret
lessons learned (prevent similar incidents in future, things that did & didn't work well - improve IR process, updates required in IR procedures)
evidence
metrics (about IR team & incidents)

Periksa Pesanan Jawaban

none

Who writes an incident response plan?

Pilih Jawaban yang Benar  

(0/0)

---

HR dept

Anyone

PR Dept

IT staff

A carefully selected group that, in addition to security and general IT staff, may include representatives from legal, human resources, and public relations departments

none

Match the definition of the IR process with the name

Cocokkan teks (klik dan seret)   

(0/0)

Periksa Order Of Answers

---

Cocokkan teks
Containment
Recovery
Eradication

Klik dan seret
stopping an incident from spreading
eliminating components of an incident
restoring affected systems to normal operation and making sure they are working as they should after an incident happens

Periksa Pesanan Jawaban

none

Match the following definitions

Cocokkan teks (klik dan seret)   

(0/0)

Periksa Order Of Answers

---

Cocokkan teks
Event
Incident (security)
observable occurances

Klik dan seret
user sends an email / server receives request for web page / firewall blocks a connection attempt
real or suspected adverse event in computer systems, network or applications
observable occurance

Periksa Pesanan Jawaban

none

Put these IR process phases in order from 1 - 4

Cocokkan teks (klik dan seret)   

(0/0)

Periksa Order Of Answers

Penjelasan

Loop between 2 & 3 and link from 4 - 1

---

Cocokkan Teks
1
2
3
4

Klik dan seret
Preparation
Post-Incident Activity
Detection & Analysis
Containment Eradication & Recovery

Periksa Pesanan Jawaban

none

Put the following core stages of the detection and analysis phase (forensic investigation) in order from start to finish = Collect Preserves @ Pats

Cocokkan teks (klik dan seret)   

(0/0)

Periksa Order Of Answers

---

Cocokkan Teks
1
2
3
4

Klik dan seret
Evidence ANAYSIS
Evidence PRESENTATION
Evidence COLLECTION
Evidence PRESERVAION

Periksa Pesanan Jawaban

none

The CMA states

Cocokkan teks (klik dan seret)   

(0/0)

Periksa Order Of Answers

---

Cocokkan teks
Incident responders must always have
An operation on a computer is defined as
Incident responders must receive
A criminal search warrant is from
A Civil warrant is from a

Klik dan seret
Police and Criminal Evidence Act
permission from a search warrant or the person within an organisation who has responsibility/ownership/authority to grant authorised access
authorisation before performing any operation on a computer
such as taking copies of HDDs for evidence or analysing the contents for reconstruction purposes (e.g., access to emails)
Civil Search Order

Periksa Pesanan Jawaban

none

What does the preparation phase of the IR process entail?

Pilih Jawaban yang Benar  

(0/0)

---

Involves risk assessment

Involves evaluating/testing these documentation The plan should be tested against: IR organisation, contact details, incident prioritisation procedure, IR procedures (SOPs) Procedures should be tested against specific threats

Involves preparing different types of documentation IR policies set the stage of the IR programme in a company/organisation The IR plan provides details for implementing the IR policies It contains Standard Operating Procedures (SOPs)

none

Some benefits of having an IR programme in organisations are

Pilih Jawaban yang Benar  

(0/0)

---

Minimises negative consequence of incidents

Allows legal actions from incidents

Allows improving security and preventing future incidents

Supports systematic response to incidents by following a consistent IR process

Allows compliance with several standards and regulations

none

For each item of desirable/potential evidence, an organisation has to evaluate and IR procedures need to reflect answers to questions such as:

Pilih Jawaban yang Benar  

(0/0)

---

Are there any legal obstacles?

Are there any contractual obstacles – e.g., within an outsourcing or cloud contract?

How will the evidence be acquired, physically & practically?

How will the evidence be preserved?

Will the evidence be admissible?

none

There is a LOOP between the Detection and Analysis phase and the Containment Eradication and Recovery Phase of the IR Process

Isi yang kosong  

(0/0)

Periksa Semua Jawaban

---

Cek Jawaban

Post-Incident Activity

Preparation

Cek Jawaban

---

Periksa Semua Jawaban

none

The purpose of an IR plan is that it provides details for implementing _____________________

Isi yang kosong  

(0/0)

Periksa Semua Jawaban

---

IR policies

IR procedures (SOPS)

Forensic Readiness Plan

Security Policies

---

Periksa Semua Jawaban

none

Match the following in relation to Incident Response

Cocokkan teks (klik dan seret)   

(0/0)

Periksa Order Of Answers

---

Cocokkan teks
Risk Management
Forensic Readiness
Information/data Management
Laws

Klik dan seret
informs
supports (M)
constrain
supports (R)

Periksa Pesanan Jawaban

none

There is a link from the Post-Incident Activity phase to the Preparation phase of the IR process

Isi yang kosong  

(0/0)

Periksa Semua Jawaban

---

Containment Eradication and Recovery

Cek Jawaban

Cek Jawaban

Detection and Analysis

---

Periksa Semua Jawaban