ONE 6th FORM Incident Response Unit 11 Cyber

The incident response policy is the document that defines what?

• How organisations create incidences

• How organisations respond to employement

• How organisations respond to incidences

• How organisations employ ICT staff

One of the things that an incident response policy defines is what?

• Responsibilities of different users

• Staff working in the organization

• Time of day to work

What is the full meaning of CSIRT?

• Cyber Security Incident Response Team

• Computer Security Incident Response Team

• Computing Security Internet Response Team

• Computer Secure Internet Response Team

A CSIRT team is usually assembled from where?

• From contracting companies

• In other companies

• Within the organization

• In consultancy

What member of the CSIRT is assigned the responsibility of coordinating responses for specific incidents?

• Incident lead

• Team leader

• Chief engineer

• Associate members

When an incident is detected or suspected what should first be done?

• Speak to the manager

• Write it on the notice board

• Report to the appropriate person

• Record it

Who performs the initial assessment when an incident report is submitted?

• Team leader

• Incident lead

• Associate members

• ICT staff

Containing the damage and minimising the risk has five areas. Select 3 from the list.

• Protecting people’s safety

• Protecting sensitive data

• Installing application software

• Recruitment plan

• Protecting other data

An event that poses a threat to the business information, in regard to its confidentiality, integrity & availability

• An information security incident

• A total data recovery failure

• A backup server breach

• A power failure in the server room

When an incident is detected or suspected what is the first action that should take place?

• It must be reported to the appropriate person (probably the CSIRT team leader)

• Whoever discovers the incident must perform an initial assessment of the event

• Switch off the servers so that no more breaches can take place

• Ignore it and hope it goes away