Q64. Except for some common roles, the roles in an IRT are distinct for every organization. Which among the following is the role played by the Incident Coordinator of an IRT?

Q65. An organization faced an information security incident where a disgruntled employee passed sensitive access
control information to a competitor. The organization’s incident response manager, upon investigation, found
that the incident must be handled within a few hours on the same day to maintain business continuity and
market competitiveness. How would you categorize such information security incident?

Q66. Which of the following techniques against insider threats identifies events that are related to suspicious activity?

Q67. An incident is analyzed for its nature, intensity and its effects on the network and systems. Which stage of the incident response and handling process involves auditing the system and network log files?

Q68. The program that helps to train people to be better prepared to respond to emergency situations in their communities is known as:

Q69. Racheal is an incident handler working at an organization called Inception Tech. Recently, numerous employees have been complaining about receiving emails from unknown senders. In order to prevent employees from spoof ng emails and keeping security in mind, Racheal was asked to take appropriate actions in this matter. As a part of her assignment, she needs to analyze the email headers to check the authenticity of received emails.
Which of the following protocol/authentication standards she must check in email header to analyze the email authenticity?

Q70. The state of incident response preparedness that enables an organization to maximize its potential to use
digital evidence while minimizing the cost of an investigation is called:

Q71. A payroll system has a vulnerability that cannot be exploited by current technology. Which of the following is correct about this scenario:

Q72. The process of rebuilding and restoring the computer systems affected by an incident to normal operational
stage including all the processes, policies and tools is known as:

Q73. Which of the following is a common tool used to help detect malicious internal or compromised actors?

Q74. The sign(s) of the presence of malicious code on a host infected by a virus which is delivered via e-mail could
be:

Q75. Which of the following is not a countermeasure to eradicate cloud security incidents?

Q76. The type of relationship between CSIRT and its constituency have an impact on the services provided by the CSIRT. Identify the level of the authority that enables members of CSIRT to undertake any necessary actions on behalf of their constituency?

Q77. Multiple component incidents consist of a combination of two or more attacks in a system.
Which of the following is not a multiple component incident?

Q78. What is the name of the type of malicious software or malware designed to deny access to a computer system or data until money is paid?

Q79. Ikeo Corp.hired an incident response team to assess the enterprise security. As part of the incident handling and response process, the IR team is reviewing the current se cunty policies implemented by the enterprise. The IR team finds that employees of the organization do not have any restrictions on Internet access: they are allowed to visit any site, download any appl cation, and access a computer or network from a remote location. Considering this as the main security threat, the IR team plans to change this policy as it can be easily exploited by attackers.
Which of the following security policies is the IR team planning to modify?

Q80. The flow chart gives a view of different roles played by the different personnel of CSIRT. Identify the incident response personnel denoted by A, B, C, D, E, F and G.

Q81. Unusual logins, accessing sensitive information not used for the job role, and the use of personal external storage drives on company assets are all signs of which of the following?

Q82. Incident may be reported using/ by:

Q83. Keyloggers do NOT:

Q84. A self-replicating malicious code that does not alter files but resides in active memory and duplicates itself,
spreads through the infected network automatically and takes advantage of file or information transport
features on the system to travel independently is called:

Q85. Which of the following is NOT one of the techniques used to respond to insider threats:

Q86. Shall y, an incident handler, is working for a company named Texas Pvt.Ltd.based in Florida. She was asked to work on an incident response plan. As part of the plan, she decided to enhance and improve the security infrastructure of the enterprise. She has incorporated a security strategy that allows security professionals to use several protection layers throughout their information system. Due to multiple layer protection, this security strategy assists in preventing direct attacks against the organization’s information system as a break in one layer only leads the attacker to the next layer.
Identify the security strategy Shall y has incorporated in the incident response plan.