0 [{"id":62543,"quiz_id":"4841","answer_id":null,"answerType_id":"2","created_at":"2016-05-05 04:49:30","updated_at":"2016-05-05 04:49:30","questionName":"Match the definition of the IR process with the name","questionTimeSeconds":"30","questionTimeMinutes":"0","questionImagePath":null,"position":null,"explanation":"","question_score_id":null,"lang":null,"questionAudioPath":null},{"id":62549,"quiz_id":"4841","answer_id":null,"answerType_id":"2","created_at":"2016-05-05 05:13:13","updated_at":"2016-05-05 05:13:13","questionName":"The CMA states","questionTimeSeconds":"0","questionTimeMinutes":"2","questionImagePath":null,"position":null,"explanation":"","question_score_id":null,"lang":null,"questionAudioPath":null},{"id":62542,"quiz_id":"4841","answer_id":null,"answerType_id":"0","created_at":"2016-05-05 04:30:35","updated_at":"2016-05-05 04:30:35","questionName":"Who writes an incident response plan?","questionTimeSeconds":"0","questionTimeMinutes":"2","questionImagePath":null,"position":null,"explanation":"","question_score_id":null,"lang":null,"questionAudioPath":null},{"id":62538,"quiz_id":"4841","answer_id":null,"answerType_id":"3","created_at":"2016-05-05 04:10:29","updated_at":"2016-05-05 04:10:29","questionName":"Put these IR process phases in order from 1 - 4","questionTimeSeconds":"0","questionTimeMinutes":"1","questionImagePath":null,"position":null,"explanation":"Loop between 2 & 3 and link from 4 - 1","question_score_id":null,"lang":null,"questionAudioPath":null},{"id":62550,"quiz_id":"4841","answer_id":null,"answerType_id":"2","created_at":"2016-05-05 05:15:36","updated_at":"2016-05-05 05:15:36","questionName":"Match the following in relation to Incident Response","questionTimeSeconds":"0","questionTimeMinutes":"2","questionImagePath":null,"position":null,"explanation":"","question_score_id":null,"lang":null,"questionAudioPath":null},{"id":62545,"quiz_id":"4841","answer_id":null,"answerType_id":"0","created_at":"2016-05-05 04:55:52","updated_at":"2016-05-05 04:55:52","questionName":"Some benefits of having an IR programme in organisations are","questionTimeSeconds":"0","questionTimeMinutes":"2","questionImagePath":null,"position":null,"explanation":"","question_score_id":null,"lang":null,"questionAudioPath":null},{"id":62539,"quiz_id":"4841","answer_id":null,"answerType_id":"1","created_at":"2016-05-05 04:13:30","updated_at":"2016-05-05 04:32:33","questionName":"The purpose of an IR plan is that it provides details for implementing _____________________","questionTimeSeconds":"0","questionTimeMinutes":"1","questionImagePath":null,"position":null,"explanation":"","question_score_id":null,"lang":null,"questionAudioPath":null},{"id":62551,"quiz_id":"4841","answer_id":null,"answerType_id":"2","created_at":"2016-05-05 05:24:17","updated_at":"2016-05-05 05:24:17","questionName":"Match the following definitions","questionTimeSeconds":"0","questionTimeMinutes":"2","questionImagePath":null,"position":null,"explanation":"","question_score_id":null,"lang":null,"questionAudioPath":null},{"id":62548,"quiz_id":"4841","answer_id":null,"answerType_id":"0","created_at":"2016-05-05 05:07:39","updated_at":"2016-05-05 05:07:39","questionName":"What does the preparation phase of the IR process entail?","questionTimeSeconds":"0","questionTimeMinutes":"2","questionImagePath":null,"position":null,"explanation":"","question_score_id":null,"lang":null,"questionAudioPath":null},{"id":62541,"quiz_id":"4841","answer_id":null,"answerType_id":"1","created_at":"2016-05-05 04:26:21","updated_at":"2016-05-05 04:26:21","questionName":"There is a link from the Post-Incident Activity phase to the Preparation phase of the IR process","questionTimeSeconds":"0","questionTimeMinutes":"1","questionImagePath":null,"position":null,"explanation":"","question_score_id":null,"lang":null,"questionAudioPath":null},{"id":62540,"quiz_id":"4841","answer_id":null,"answerType_id":"1","created_at":"2016-05-05 04:24:01","updated_at":"2016-05-05 04:24:01","questionName":"There is a LOOP between the Detection and Analysis phase and the Containment Eradication and Recovery Phase of the IR Process","questionTimeSeconds":"0","questionTimeMinutes":"2","questionImagePath":null,"position":null,"explanation":"","question_score_id":null,"lang":null,"questionAudioPath":null},{"id":62544,"quiz_id":"4841","answer_id":null,"answerType_id":"2","created_at":"2016-05-05 04:53:22","updated_at":"2016-05-05 04:53:22","questionName":"Post-Incident phase if IR process","questionTimeSeconds":"0","questionTimeMinutes":"2","questionImagePath":null,"position":null,"explanation":"","question_score_id":null,"lang":null,"questionAudioPath":null},{"id":62547,"quiz_id":"4841","answer_id":null,"answerType_id":"0","created_at":"2016-05-05 05:05:14","updated_at":"2016-05-05 05:06:57","questionName":"For each item of desirable\/potential evidence, an organisation has to evaluate and IR procedures need to reflect answers to questions such as:","questionTimeSeconds":"0","questionTimeMinutes":"2","questionImagePath":null,"position":null,"explanation":"","question_score_id":null,"lang":null,"questionAudioPath":null},{"id":62546,"quiz_id":"4841","answer_id":null,"answerType_id":"3","created_at":"2016-05-05 05:03:25","updated_at":"2016-05-05 05:03:25","questionName":"Put the following core stages of the detection and analysis phase (forensic investigation) in order from start to finish = Collect Preserves @ Pats","questionTimeSeconds":"0","questionTimeMinutes":"2","questionImagePath":"uploads\/ihw-os-sem-2\/Picture1.png","position":null,"explanation":"","question_score_id":null,"lang":null,"questionAudioPath":null}]

block

Match the definition of the IR process with the name

Match the text (click and drag)   

(0/0)

Check Order Of Answers

---

Match the text
Containment
Recovery
Eradication

Click and drag
restoring affected systems to normal operation and making sure they are working as they should after an incident happens
stopping an incident from spreading
eliminating components of an incident

Check Order of Answers

none

The CMA states

Match the text (click and drag)   

(0/0)

Check Order Of Answers

---

Match the text
Incident responders must always have
An operation on a computer is defined as
Incident responders must receive
A criminal search warrant is from
A Civil warrant is from a

Click and drag
Civil Search Order
permission from a search warrant or the person within an organisation who has responsibility/ownership/authority to grant authorised access
authorisation before performing any operation on a computer
such as taking copies of HDDs for evidence or analysing the contents for reconstruction purposes (e.g., access to emails)
Police and Criminal Evidence Act

Check Order of Answers

none

Who writes an incident response plan?

Select the correct answer(s).  

(0/0)

---

Anyone

A carefully selected group that, in addition to security and general IT staff, may include representatives from legal, human resources, and public relations departments

IT staff

HR dept

PR Dept

none

Put these IR process phases in order from 1 - 4

Match the text (click and drag)   

(0/0)

Check Order Of Answers

Explanation

Loop between 2 & 3 and link from 4 - 1

---

Match the Text
1
2
3
4

Click and drag
Detection & Analysis
Post-Incident Activity
Preparation
Containment Eradication & Recovery

Check Order of Answers

none

Match the following in relation to Incident Response

Match the text (click and drag)   

(0/0)

Check Order Of Answers

---

Match the text
Risk Management
Forensic Readiness
Information/data Management
Laws

Click and drag
constrain
supports (M)
supports (R)
informs

Check Order of Answers

none

Some benefits of having an IR programme in organisations are

Select the correct answer(s).  

(0/0)

---

Supports systematic response to incidents by following a consistent IR process

Allows legal actions from incidents

Allows improving security and preventing future incidents

Allows compliance with several standards and regulations

Minimises negative consequence of incidents

none

The purpose of an IR plan is that it provides details for implementing _____________________

Fill in the blanks  

(0/0)

Check All Answers

---

IR policies

IR procedures (SOPS)

Forensic Readiness Plan

Security Policies

---

Check All Answers

none

Match the following definitions

Match the text (click and drag)   

(0/0)

Check Order Of Answers

---

Match the text
Event
Incident (security)
observable occurances

Click and drag
observable occurance
user sends an email / server receives request for web page / firewall blocks a connection attempt
real or suspected adverse event in computer systems, network or applications

Check Order of Answers

none

What does the preparation phase of the IR process entail?

Select the correct answer(s).  

(0/0)

---

Involves risk assessment

Involves evaluating/testing these documentation The plan should be tested against: IR organisation, contact details, incident prioritisation procedure, IR procedures (SOPs) Procedures should be tested against specific threats

Involves preparing different types of documentation IR policies set the stage of the IR programme in a company/organisation The IR plan provides details for implementing the IR policies It contains Standard Operating Procedures (SOPs)

none

There is a link from the Post-Incident Activity phase to the Preparation phase of the IR process

Fill in the blanks  

(0/0)

Check All Answers

---

Containment Eradication and Recovery

Check Answer

Check Answer

Detection and Analysis

---

Check All Answers

none

There is a LOOP between the Detection and Analysis phase and the Containment Eradication and Recovery Phase of the IR Process

Fill in the blanks  

(0/0)

Check All Answers

---

Check Answer

Post-Incident Activity

Preparation

Check Answer

---

Check All Answers

none

Post-Incident phase if IR process

Match the text (click and drag)   

(0/0)

Check Order Of Answers

---

Match the text
involves collection of
involves collection/analysis of
involves retention of

Click and drag
metrics (about IR team & incidents)
evidence
lessons learned (prevent similar incidents in future, things that did & didn't work well - improve IR process, updates required in IR procedures)

Check Order of Answers

none

For each item of desirable/potential evidence, an organisation has to evaluate and IR procedures need to reflect answers to questions such as:

Select the correct answer(s).  

(0/0)

---

How will the evidence be preserved?

Are there any contractual obstacles – e.g., within an outsourcing or cloud contract?

Are there any legal obstacles?

Will the evidence be admissible?

How will the evidence be acquired, physically & practically?

none

Put the following core stages of the detection and analysis phase (forensic investigation) in order from start to finish = Collect Preserves @ Pats

Match the text (click and drag)   

(0/0)

Check Order Of Answers

---

Match the Text
1
2
3
4

Click and drag
Evidence COLLECTION
Evidence ANAYSIS
Evidence PRESENTATION
Evidence PRESERVAION

Check Order of Answers