University:
Eastern Kentucky University
Course:
NSM 815 | Foundations of Network Sec
Academic year:

2021
Views:

177

Pages:

15
Author:

ilikemyicons0y5

Name  : Clas  s: Dat  e: Module 05 - Incident Response: Organizing and Preparing the CSIRT True / False 1. The CSIRT may also be known as the IR reaction team.  a. True  b. False ANSWER: True POINTS: 1 REFERENCES: p. 128 H1: Introduction QUESTIONTYPE: True / False HASVARIABLES: False LEARNINGOBJECTIVES: 5.1 - Describe the purpose and function of the CSIRT DATECREATED: 4/16/2020 9:59 AM DATEMODIFIED: 1/1/2021 12:11 PM 2. Without formal management support at all levels, from the top down to each supervisor, any organization-wide effort will fail.  a. True  b. False ANSWER: True POINTS: 1 REFERENCES: H1: BUILDING THE CSIRT H2: Step 1: Obtaining Management Support and Buy-In p. 129 QUESTIONTYPE: True / False HASVARIABLES: False LEARNINGOBJECTIVES:5.1 - Describe the purpose and function of the CSIRT DATECREATED: 9/16/2020 3:29 PM DATEMODIFIED: 9/16/2020 3:30 PM 3. Establishing the scope and responsibilities of the CSIRT is one of the last tasks the IRPT performs when forming the CSIRT.  a. True  b. False ANSWER: False POINTS: 1 REFERENCES: H1: BUILDING THE CSIRT H2: Step 3: Gathering Relevant Information p. 133 QUESTIONTYPE: True / False HASVARIABLES: False LEARNINGOBJECTI 5.1 - Describe the purpose and function of the CSIRT VES: 5.3 - Explain the standard operating procedures associated with CSIRTs Page1 Name  : Clas  s: Dat  e: Module 05 - Incident Response: Organizing and Preparing the CSIRT DATECREATED: 9/16/2020 3:37 PM DATEMODIFIED: 9/16/2020 3:38 PM 4. Regardless of which IR model an organization chooses, multiple employees should be in charge of incident response.  a. True  b. False ANSWER: False POINTS: 1 REFERENCES: p. 140 H1: BUILDING THE CSIRT H2: Step 4: Designing the CSIRT’s Vision QUESTIONTYPE: True / False HASVARIABLES: False LEARNINGOBJECTIVES: 5.1 - Describe the purpose and function of the CSIRT DATECREATED: 4/16/2020 9:59 AM DATEMODIFIED: 4/16/2020 9:59 AM 5. One of the first signals that an organization is making progress in the development of its IR program, specifically in the development of its CSIRT, is a dramatic drop in the number of identified incidents.  a. True  b. False ANSWER: False POINTS: 1 REFERENCES: p. 144 H1: BUILDING THE CSIRT H2: Final Thoughts on CSIRT Development QUESTIONTYPE: True / False HASVARIABLES: False LEARNINGOBJECTIVES: 5.1 - Describe the purpose and function of the CSIRT DATECREATED: 4/16/2020 9:59 AM DATEMODIFIED: 4/16/2020 9:59 AM 6. Organizations should focus solely on the current quality of work by a potential service provider.  a. True  b. False ANSWER: False POINTS: 1 REFERENCES: p. 145 H1: SPECIAL CIRCUMSTANCES IN CSIRT DEVELOPMENT AND OPERATIONS H2: Outsourcing Incident Response and the CSIRT QUESTIONTYPE:True / False HASVARIABLES:False LEARNINGOBJE 5.5 - Identify the special circumstances of CSIRT interaction with the security operations center Page2 Name  : Clas  s: Dat  e: Module 05 - Incident Response: Organizing and Preparing the CSIRT CTIVES: (SOC) and when outsourcing incident response operations DATECREATED:9/16/2020 3:43 PM DATEMODIFIED:9/16/2020 3:44 PM  Multiple Choice 7. The champion for the CSIRT may be the same person as the champion for the entire IR function—typically, the ____.  a. chief executive officer  b. chief information officer  c. IT manager  d. operations manager ANSWER: b POINTS: 1 REFERENCES: p. 129 H1: BUILDING THE CSIRT H2: Step 1: Obtaining Management Support and Buy-In QUESTIONTYPE: Multiple Choice HASVARIABLES: False LEARNINGOBJECTIVES:5.1 - Describe the purpose and function of the CSIRT DATECREATED: 4/16/2020 9:59 AM DATEMODIFIED: 1/1/2021 1:15 PM 8. The organization must first understand what skills are needed to effectively respond to an incident. If necessary, management must determine if it is willing to acquire needed ____ to fill in the gaps.  a. policies  b. personnel  c. equipment  d. administration ANSWER: b POINTS: 1 REFERENCES: p. 130 H1: BUILDING THE CSIRT H2: Step 2: Determining the CSIRT Strategic Plan QUESTIONTYPE: Multiple Choice HASVARIABLES: False LEARNINGOBJECTIVES: 5.1 - Describe the purpose and function of the CSIRT DATECREATED: 4/16/2020 9:59 AM DATEMODIFIED: 1/1/2021 1:15 PM 9. The CSIRT should be available for contact by anyone who discovers or suspects that an incident involving the organization has occurred. Some organizations prefer that employees contact the____, which then determines whether to contact the CSIRT.  a. Contingency Planning Team Page3 Name  : Clas  s: Dat  e: Module 05 - Incident Response: Organizing and Preparing the CSIRT  b. system administration c. Computer Emergency Response Team d. help desk ANSWER: d POINTS: 1 REFERENCES: p. 130 H1: BUILDING THE CSIRT H2: Step 2: Determining the CSIRT Strategic Plan QUESTIONTYPE: Multiple Choice HASVARIABLES: False LEARNINGOBJECTIVES: 5.1 - Describe the purpose and function of the CSIRT DATECREATED: 4/16/2020 9:59 AM DATEMODIFIED: 1/1/2021 1:16 PM   10. A CSIRT model in which a single CSIRT handles incidents throughout the organization is called a(n) ____.  a. employee-based CSIRT  b. coordinating team  c. central CSIRT  d. organizational CSIRT ANSWER: c POINTS: 1 REFERENCES: p. 131 H1: BUILDING THE CSIRT H2: Step 2: Determining the CSIRT Strategic Plan QUESTIONTYPE: Multiple Choice HASVARIABLES: False LEARNINGOBJECTIVES: 5.1 - Describe the purpose and function of the CSIRT DATECREATED: 4/16/2020 9:59 AM DATEMODIFIED: 1/1/2021 1:16 PM 11. A CSIRT model that is effective for large organizations and for organizations with major computing resources at distant locations is the ____.  a. central CSIRT  b. coordinating team  c. organizational CSIRT  d. distributed CSIRT ANSWER: d POINTS: 1 REFERENCES: p. 131 H1: BUILDING THE CSIRT H2: Step 2: Determining the CSIRT Strategic Plan QUESTIONTYPE: Multiple Choice HASVARIABLES: False Page4 Name  : Clas  s: Dat  e: Module 05 - Incident Response: Organizing and Preparing the CSIRT LEARNINGOBJECTIVES: 5.1 - Describe the purpose and function of the CSIRT DATECREATED: 4/16/2020 9:59 AM DATEMODIFIED: 1/1/2021 1:16 PM 12. The _____ CSIRT model is used when the organization needs a full-time, on-site CSIRT but does not have enough available, qualified employees.  a. fully outsourced  b. partially outsourced  c. employees  d. 24/7 ANSWER: a POINTS: 1 REFERENCES: p. 131 H1: BUILDING THE CSIRT H2: Step 2: Determining the CSIRT Strategic Plan QUESTIONTYPE: Multiple Choice HASVARIABLES: False LEARNINGOBJECTIVES: 5.1 - Describe the purpose and function of the CSIRT DATECREATED: 4/16/2020 9:59 AM DATEMODIFIED: 1/1/2021 1:16 PM 13. Organizations with limited funding, staffing, or IR needs may have only _____ IR team members.  a. temporary  b. full-time  c. contract  d. part-time ANSWER: d POINTS: 1 REFERENCES: H1: BUILDING THE CSIRT H2: Step 2: Determining the CSIRT Strategic Plan p. 132 QUESTIONTYPE: Multiple Choice HASVARIABLES: False LEARNINGOBJECTIVES: 5.1 - Describe the purpose and function of the CSIRT DATECREATED: 9/16/2020 4:11 PM DATEMODIFIED: 1/1/2021 1:16 PM 14. The ____ flow of information needed from the CSIRT to organizational and IT/InfoSec management is a critical communication requirement.  a. operations  b. identifying  c. geographic  d. upward Page5 Name  : Clas  s: Dat  e: Module 05 - Incident Response: Organizing and Preparing the CSIRT d 1 p. 133 H1: BUILDING THE CSIRT H2: Step 2: Determining the CSIRT Strategic Plan QUESTIONTYPE: Multiple Choice HASVARIABLES: False LEARNINGOBJECTIVES: 5.1 - Describe the purpose and function of the CSIRT DATECREATED: 4/16/2020 9:59 AM DATEMODIFIED: 1/1/2021 1:16 PM ANSWER: POINTS: REFERENCES: 15. The CSIRT must have a clear and concise ____ statement that, in a few sentences, unambiguously articulates what it will do.  a. objectives  b. mission  c. philosophy  d. requirements ANSWER: b POINTS: 1 REFERENCES: p. 135 H1: BUILDING THE CSIRT H2: Step 4: Designing the CSIRT’s Vision QUESTIONTYPE: Multiple Choice HASVARIABLES: False LEARNINGOBJECTIVES: 5.1 - Describe the purpose and function of the CSIRT DATECREATED: 4/16/2020 9:59 AM DATEMODIFIED: 1/1/2021 1:16 PM 16. A key step in the ____ approach to incident response is to discover the identity of the intruder while documenting their activity.  a. apprehend and prosecute  b. proactive security awareness  c. security quality management  d. protect and forget ANSWER: a POINTS: 1 REFERENCES: p. 136 H1: BUILDING THE CSIRT H2: Step 4: Designing the CSIRT’s Vision QUESTIONTYPE: Multiple Choice HASVARIABLES: False LEARNINGOBJECTIVES: 5.1 - Describe the purpose and function of the CSIRT DATECREATED: 4/16/2020 9:59 AM Page6 Name  : Clas  s: Dat  e: Module 05 - Incident Response: Organizing and Preparing the CSIRT DATEMODIFIED: 1/1/2021 1:17 PM 17. Services performed in response to a request or a defined event such as a help desk alert are called ____.  a. vulnerability assessment services  b. security quality management services  c. proactive services  d. reactive services ANSWER: d POINTS: 1 REFERENCES: p. 138 H1: BUILDING THE CSIRT H2: Step 4: Designing the CSIRT’s Vision QUESTIONTYPE: Multiple Choice HASVARIABLES: False LEARNINGOBJECTIVES: 5.1 - Describe the purpose and function of the CSIRT DATECREATED: 4/16/2020 9:59 AM DATEMODIFIED: 1/1/2021 1:17 PM 18. Services undertaken to prepare the organization or the CSIRT constituents to protect and secure systems in anticipation of problems, attacks, or other events are called ____.  a. vulnerability assessment services  b. security quality management services  c. proactive services  d. reactive services ANSWER: c POINTS: 1 REFERENCES: p. 138 H1: BUILDING THE CSIRT H2: Step 4: Designing the CSIRT’s Vision QUESTIONTYPE: Multiple Choice HASVARIABLES: False LEARNINGOBJECTIVES: 5.1 - Describe the purpose and function of the CSIRT DATECREATED: 4/16/2020 9:59 AM DATEMODIFIED: 1/1/2021 1:17 PM 19. In the absence of the assigned team manager, the ____ should assume authority for overseeing and evaluating a provided service.  a. deputy team manager  b. CSIRT leader  c. IRP team leader  d. technical lead ANSWER: a POINTS: 1 Page7 Name  : Clas  s: Dat  e: Module 05 - Incident Response: Organizing and Preparing the CSIRT REFERENCES: QUESTIONTYPE: HASVARIABLES: LEARNINGOBJECTIVES: DATECREATED: DATEMODIFIED: p. 140 H1: BUILDING THE CSIRT H2: Step 4: Designing the CSIRT’s Vision Multiple Choice False 5.1 - Describe the purpose and function of the CSIRT 4/16/2020 9:59 AM 1/1/2021 1:17 PM 20. One way to build and maintain staff skills is to develop incident-handling ____ and have the team members discuss how they would handle them.  a. plans  b. IR teams  c. scenarios  d. technologies ANSWER: c POINTS: 1 REFERENCES: p. 141 H1: BUILDING THE CSIRT H2: Step 4: Designing the CSIRT’s Vision QUESTIONTYPE: Multiple Choice HASVARIABLES: False LEARNINGOBJECTIVES: 5.2 - Recognize the meanings of common prefixes, suffixes, and word roots. DATECREATED: 4/16/2020 9:59 AM DATEMODIFIED: 1/1/2021 1:18 PM 21. The first group or person to communicate the CSIRT’s vision and operational plan is the managerial team or individual serving as the ____.  a. technical lead  b. educational liaison  c. IT staff leader  d. champion ANSWER: d POINTS: 1 REFERENCES: H1: BUILDING THE CSIRT H2: Step 5: Communicating the CSIRT’s Vision and Operational Plan p. 141 QUESTIONTYPE: Multiple Choice HASVARIABLES: False LEARNINGOBJECTIV 5.1 - Describe the purpose and function of the CSIRT ES: DATECREATED: 4/16/2020 9:59 AM DATEMODIFIED: 1/1/2021 1:18 PM Page8 Name  : Clas  s: Dat  e: Module 05 - Incident Response: Organizing and Preparing the CSIRT 22. The announcement of an operational CSIRT should at a minimum include ____.  a. contact methods and numbers  b. the IR policy statement  c. a list of all IDPS equipment  d. statistical baselines for systems ANSWER: a POINTS: 1 REFERENCES: H1: BUILDING THE CSIRT H2: Step 7: Announcing the Operational CSIRT p. 142-143 QUESTIONTYPE: Multiple Choice HASVARIABLES: False LEARNINGOBJECTIVES: 5.4 - Describe training and deployment of the CSIRT DATECREATED: 4/16/2020 9:59 AM DATEMODIFIED: 1/1/2021 1:18 PM 23. During the AAR, all team members primarily _____.  a. review other members of the team during the incident and identify areas for improvement  b. review the actions of management during the incident and identify areas of excellence  c. review their actions during the incident and identify areas for improvement  d. review other members of the team during the incident and identify areas of excellence ANSWER: c POINTS: 1 REFERENCES: p. 143 H1: BUILDING THE CSIRT H2: Step 8: Evaluating the CSIRT’s Effectiveness QUESTIONTYPE: Multiple Choice HASVARIABLES: False LEARNINGOBJECTIVES: 5.4 - Describe training and deployment of the CSIRT DATECREATED: 9/16/2020 4:17 PM DATEMODIFIED: 1/1/2021 1:18 PM 24. A feedback mechanism that can be used to measure the effectiveness of a CSIRT is the ____.  a. after-action review  b. IR plan test  c. periodic survey  d. help-desk report log ANSWER: c POINTS: 1 REFERENCES: p. 143 H1: BUILDING THE CSIRT H2: Step 8: Evaluating the CSIRT’s Effectiveness QUESTIONTYPE: Multiple Choice Page9 Name  : Clas  s: Dat  e: Module 05 - Incident Response: Organizing and Preparing the CSIRT HASVARIABLES: LEARNINGOBJECTIVES: DATECREATED: DATEMODIFIED: False 5.4 - Describe training and deployment of the CSIRT 4/16/2020 9:59 AM 1/1/2021 12:21 PM 25. CSIRT measures used to compare current versus past performance might include all of the following EXCEPT:  a. Number and types of incidents reported  b. Response times  c. Text of comments from users  d. Resolution rates for reported incidents ANSWER: c POINTS: 1 REFERENCES: p. 143 H1: BUILDING THE CSIRT H2: Step 8: Evaluating the CSIRT’s Effectiveness QUESTIONTYPE: Multiple Choice HASVARIABLES: False LEARNINGOBJECTIVES: 5.4 - Describe training and deployment of the CSIRT DATECREATED: 9/16/2020 4:21 PM DATEMODIFIED: 1/1/2021 1:18 PM 26. While a security operations center is designed to _____, a CSIRT focuses on _____.  a. monitor all security operations; responding to incidents  b. monitor all security operations; preventing security incidents  c. respond to incidents; monitoring all security operations;  d. prevent security incidents; responding to incidents ANSWER: a POINTS: 1 REFERENCES: p. 144 H1: SPECIAL CIRCUMSTANCES IN CSIRT DEVELOPMENT AND OPERATIONS H2: CSIRT Operations and the Security Operations Center QUESTIONTYPE:Multiple Choice HASVARIABLES:False LEARNINGOBJE 5.5 - Identify the special circumstances of CSIRT interaction with the security operations center CTIVES: (SOC) and when outsourcing incident response operations DATECREATED:9/16/2020 4:24 PM DATEMODIFIED:1/1/2021 12:22 PM  Completion 27. CSIRT is an acronym for ____________________. ANSWER: Computer Security Incident Response Team Page10 Name  : Clas  s: Dat  e: Module 05 - Incident Response: Organizing and Preparing the CSIRT POINTS: REFERENCES: QUESTIONTYPE: HASVARIABLES: STUDENTENTRYMODE: LEARNINGOBJECTIVES: DATECREATED: DATEMODIFIED: 1 p. 128 H1: BUILDING THE CSIRT Completion False Basic 5.1 - Describe the purpose and function of the CSIRT 4/16/2020 9:59 AM 4/16/2020 9:59 AM 28. Developing the CSIRT requires a formal plan that encompasses the scope and _____ of the team as well as its reporting structure and functional processes. ANSWER: responsibilities POINTS: 1 REFERENCES: H1: BUILDING THE CSIRT H2: Step 2: Determining the CSIRT Strategic Plan p. 129 QUESTIONTYPE: Completion HASVARIABLES: False STUDENTENTRYMODE: Basic LEARNINGOBJECTIVES: 5.1 - Describe the purpose and function of the CSIRT DATECREATED: 9/16/2020 4:29 PM DATEMODIFIED: 1/1/2021 12:24 PM 29. A CSIRT that provides guidance and advice to other teams without having authority over those teams is called a(n) _____ team. ANSWER: coordinating POINTS: 1 REFERENCES: p. 131 H1: BUILDING THE CSIRT H2: Step 2: Determining the CSIRT Strategic Plan QUESTIONTYPE: Completion HASVARIABLES: False STUDENTENTRYMODE: Basic LEARNINGOBJECTIVES: 5.1 - Describe the purpose and function of the CSIRT DATECREATED: 4/16/2020 9:59 AM DATEMODIFIED: 1/1/2021 12:24 PM 30. A member of the organization’s CSIRT designated to respond to a specific type is called the incident _____. ANSWER: handler POINTS: 1 REFERENCES: H1: BUILDING THE CSIRT H2: Step 2: Determining the CSIRT Strategic Plan Page11 Name  : Clas  s: Dat  e: Module 05 - Incident Response: Organizing and Preparing the CSIRT QUESTIONTYPE: HASVARIABLES: STUDENTENTRYMODE: LEARNINGOBJECTIVES: DATECREATED: DATEMODIFIED: p. 131 Completion False Basic 5.1 - Describe the purpose and function of the CSIRT 9/16/2020 4:32 PM 1/1/2021 12:25 PM 31. In order to do an effective job, the CSIRT needs to know who it works for and what systems it should focus on; in other words, it needs to identify its ____________________. ANSWER: constituency POINTS: 1 REFERENCES: H1: BUILDING THE CSIRT H2: Step 4: Designing the CSIRT's Vision p. 134 QUESTIONTYPE: Completion HASVARIABLES: False STUDENTENTRYMODE: Basic LEARNINGOBJECTIVES: 5.3 - Explain the standard operating procedures associated with CSIRTs DATECREATED: 4/16/2020 9:59 AM DATEMODIFIED: 4/16/2020 9:59 AM 32. In the '_____ and forget' approach, the focus is on the defense of the data and the systems that house, use, and transmit it. ANSWER: protect POINTS: 1 REFERENCES: H1: BUILDING THE CSIRT H2: Step 4: Designing the CSIRT’s Vision p. 136 QUESTIONTYPE: Completion HASVARIABLES: False STUDENTENTRYMODE: Basic LEARNINGOBJECTIVES: 5.1 - Describe the purpose and function of the CSIRT DATECREATED: 9/16/2020 4:35 PM DATEMODIFIED: 9/16/2020 4:38 PM 33. When a CSIRT provides a _____ service, it is performed in response to a request or a defined event, such as a helpdesk alert, an IDPS alarm, or a vendor alert of an emerging vulnerability. ANSWER: reactive POINTS: 1 REFERENCES: H1: BUILDING THE CSIRT H2: Step 4: Designing the CSIRT’s Vision p. 138 Page12 Name  : Clas  s: Dat  e: Module 05 - Incident Response: Organizing and Preparing the CSIRT QUESTIONTYPE: HASVARIABLES: STUDENTENTRYMODE: LEARNINGOBJECTIVES: DATECREATED: DATEMODIFIED: Completion False Basic 5.1 - Describe the purpose and function of the CSIRT 9/16/2020 4:40 PM 1/1/2021 12:58 PM 34. The CSIRT representative in charge of the team’s response to a specific incident (not to be confused with the CSIRT manager or lead) is usually referred to as an incident _____. ANSWER: commander POINTS: 1 REFERENCES: H1: BUILDING THE CSIRT H2: Step 4: Designing the CSIRT’s Vision p. 140 QUESTIONTYPE: Completion HASVARIABLES: False STUDENTENTRYMODE: Basic LEARNINGOBJECTIVES: 5.1 - Describe the purpose and function of the CSIRT DATECREATED: 9/16/2020 4:43 PM DATEMODIFIED: 1/1/2021 12:59 PM 35. Communicating the CSIRT’s vision and plan begins with the managerial team or the individual serving as _____. ANSWER: champion POINTS: 1 REFERENCES: H1: BUILDING THE CSIRT H2: Step 5: Communicating the CSIRT’s Vision and Operational Plan p. 141 QUESTIONTYPE: Completion HASVARIABLES: False STUDENTENTRYMOD Basic E: LEARNINGOBJECTIVE5.1 - Describe the purpose and function of the CSIRT S: DATECREATED: 9/16/2020 4:45 PM DATEMODIFIED: 9/16/2020 4:46 PM 36. The _____ is a detailed examination of the events that occurred in a test, exercise, or assessment function, from first detection to final recovery. ANSWER: after-action review after-action review (AAR) AAR POINTS: 1 REFERENCES: p. 143 H1: BUILDING THE CSIRT Page13 Name  : Clas  s: Dat  e: Module 05 - Incident Response: Organizing and Preparing the CSIRT QUESTIONTYPE: HASVARIABLES: STUDENTENTRYMODE: LEARNINGOBJECTIVES: DATECREATED: DATEMODIFIED: H2: Step 8: Evaluating the CSIRT’s Effectiveness Completion False Basic 5.4 - Describe training and deployment of the CSIRT 4/16/2020 9:59 AM 1/1/2021 12:59 PM 37. Performance measures are also known as _____. ANSWER: metrics POINTS: 1 REFERENCES: p. 143 H1: BUILDING THE CSIRT H2: Step 8: Evaluating the CSIRT’s Effectiveness QUESTIONTYPE: Completion HASVARIABLES: False STUDENTENTRYMODE: Basic LEARNINGOBJECTIVES: 5.4 - Describe training and deployment of the CSIRT DATECREATED: 4/16/2020 9:59 AM DATEMODIFIED: 9/25/2020 7:11 PM 38. A centralized facility where the organization’s security efforts and technologies are monitored by dedicated technicians is known as the _____. ANSWER: security operations center SOC POINTS: 1 REFERENCES: H1: SPECIAL CIRCUMSTANCES IN CSIRT DEVELOPMENT AND OPERATIONS p. 144 QUESTIONTYPE:Completion HASVARIABLES:False STUDENTENTRY Basic MODE: LEARNINGOBJE 5.5 - Identify the special circumstances of CSIRT interaction with the security operations center CTIVES: (SOC) and when outsourcing incident response operations DATECREATED:9/16/2020 4:47 PM DATEMODIFIED:9/16/2020 4:48 PM  Subjective Short Answer 39. Carnegie Mellon University’s Software Engineering Institute recommends that the development of the CSIRT involve a set of steps. What are these steps? ANSWER: In more formal situations, the Software Engineering Institute at Carnegie Mellon University recommends that the development of the CSIRT Page14 Name  : Clas  s: Dat  e: Module 05 - Incident Response: Organizing and Preparing the CSIRT involve the following stages: Step 1: Obtain management support and buy-in. Step 2: Determine the CSIRT strategic plan. Step 3: Gather relevant information. Step 4: Design the CSIRT's vision. Step 5: Communicate the CSIRT's vision and operational plan. Step 6: Begin CSIRT implementation. Step 7: Announce the operational CSIRT. Step 8: Evaluate the CSIRT's effectiveness. POINTS: 1 REFERENCES: H1: BUILDING THE CSIRT p. 128-129 QUESTIONTYPE:Subjective Short Answer HASVARIABLES: False STUDENTENTRY Basic MODE: LEARNINGOBJEC 5.1 - Describe the purpose and function of the CSIRT TIVES: 5.3 - Explain the standard operating procedures associated with CSIRTs DATECREATED: 4/16/2020 9:59 AM DATEMODIFIED:1/1/2021 1:02 PM 40. As with any formal effort, developing the CSIRT requires a formal plan, which encompasses the scope and responsibilities of the team as well as its reporting structure and functional processes. What items should this plan address? ANSWER: The plan should address the following items: Time frame for development of the CSIRT Gap analysis of needed versus available personnel resources (skills) CSIRT structure and team model Available and needed funding for initial and ongoing CSIRT operations Training and testing methods and requirements for the CSIRT Formal and informal communications requirements between the CSIRT and existing IT/InfoSec operations, organizational management, and other responsible individuals Procedures for updating and modifying CSIRT documents and activities, including findings from training and testing methods POINTS: 1 REFERENCES: H1: BUILDING THE CSIRT H2: Step 2: Determining the CSIRT Strategic Plan p. 129-130 QUESTIONTYPE:Subjective Short Answer HASVARIABLES:False STUDENTENTRY Basic MODE: LEARNINGOBJE 5.1 - Describe the purpose and function of the CSIRT CTIVES: 5.3 - Explain the standard operating procedures associated with CSIRTs DATECREATED:4/16/2020 9:59 AM DATEMODIFIED:4/16/2020 9:59 AM Page15

Incident Response Organizingand Preparing the CSIRT True False

Related Documents

Recommended Documents

Description

Related Documents

Almost There!

Free up your schedule!

Take 5 seconds to unlock