601uC

Which of the following is least volatile according to the forensic order of volatility?

• CPU registers 

• Hard drives

• Routing tables

• Cache memory

As part of monthly incident response preparations, your organization goes through a sample incident step by step to validate what each person will do in the incident. What type of exercise is this?

• Walkthrough

• Checklist test

• ISCP

• Simulation test

Which of the following is a site without hardware set up in advance?

• Cold spare

• Cold site

• Hot spare

• Hot site 

Which of the following allows redundancy by saving data to multiple hard drives at once?

• NIC teaming 

• RAID

• Redundant power supply

• Back power source

Which of the following is the most serious concern when rebuilding the content of a failed RAID drive from parity?

• The resulting rebuilt drive may not be a perfect mirror of the remaining good drive.

  option

• The array must be based on RAID 0.

  option

• The rebuild will not work if the array uses striping.

  option

• Other drives in the array may fail.

What document specifically covers moving operations to a temporary site?

• DRP

• COOP

• BCP

• BIA

Answer explanation

A continuity of operations plan (COOP) includes procedures for moving critical operations to a temporary site during disaster recovery. It can apply to general business functions as well as IT systems in particular.

After a security incident, you rush to take a screenshot of a telltale running process before you leisurely take a backup of suspicious files on the hard drive. What forensic principle are you exercising?

• Order of volatility

• eDiscovery

• Chain of custody

• Audit trail

Which of the following is an office-productivity device that may be a common fixture around the enterprise, but from a security perspective frequently slips through the cracks because no one configured existing security controls or added external ones?

• VoIP

• RTOS

• HVAC

• MFP

Which of the following is a process where you identify, secure, and analyze data with the intent of using it in a criminal or civil court case?

• Industrial camouflage

• Dual control violation

• eDiscovery

• Signal surveys

Which of the following statements about RAID 5 is accurate?

• RAID 5 allows the creation of an array by using differing amounts of storage from three or more drives.

• RAID 5 can be implemented only with an even number of drives.

• Because RAID 5 creates a parity block for each stripe, separately backing up data from the array is not necessary.

• To create a RAID 5 array, you not only need enough drives to help cover the desired capacity of the array, but an additional drive to help cover the necessary amount of protective parity.