Computer Emergency Response Team! Trivia Quiz
.
Questions and Answers
- 1.
Below are the lists of types of training suitable to train CSIRT except for:
- A.
Establish mentoring system
- B.
Encourage self study
- C.
Involve team members in incident simulation
- D.
None of the above
Correct Answer
D. None of the aboveExplanation
The given options are all types of training suitable to train CSIRT. Establishing a mentoring system can provide guidance and support to team members, encouraging self-study allows individuals to enhance their knowledge and skills independently, and involving team members in incident simulation helps them gain hands-on experience in handling real-life scenarios. Therefore, all the options listed are appropriate types of training for CSIRT.Rate this question:
-
- 2.
The acceptance of the CSIRT team in an organization depends on:
- A.
Its ability to coordinate with other organizations
- B.
The expertise and professionalism it displays
- C.
Its perceived capabilities
- D.
All of the above
Correct Answer
D. All of the aboveExplanation
The acceptance of the CSIRT team in an organization depends on its ability to coordinate with other organizations, the expertise and professionalism it displays, and its perceived capabilities. This means that for the CSIRT team to be accepted and trusted within the organization, they need to effectively collaborate and communicate with other organizations, demonstrate their knowledge and skills in handling incidents, and create a perception of being capable and reliable in responding to and mitigating cyber threats.Rate this question:
-
- 3.
Which of these are not part of the steps taken under the preparation phase in Incident Response Methodology?
- A.
Develop the IR policy
- B.
Organize the CSIRT
- C.
Gathering incident logs and write report
- D.
Gathering information from stakeholders and constituency
Correct Answer
C. Gathering incident logs and write reportExplanation
The given answer "Gathering incident logs and write report" is not part of the steps taken under the preparation phase in Incident Response Methodology. The preparation phase mainly involves developing the IR policy and organizing the CSIRT (Computer Security Incident Response Team). Gathering incident logs and writing a report are typically part of the detection and analysis phase, where the incident is investigated and documented.Rate this question:
-
- 4.
What are the barriers to success in organizing a team?
- A.
Law
- B.
Politics
- C.
Specialist
- D.
None of the above
Correct Answer
B. PoliticsExplanation
Politics can be a barrier to success in organizing a team because it involves the use of power, influence, and manipulation to gain control or advantage. When politics come into play, individuals may prioritize personal interests over the goals of the team, leading to conflicts, lack of cooperation, and a breakdown in communication. This can hinder the team's ability to work together effectively and achieve their objectives.Rate this question:
-
- 5.
The __________ department typically controls all physical access to the facility.
- A.
Physical security
- B.
Law and regulations
- C.
Human resource
- D.
Administration
Correct Answer
A. Physical securityExplanation
The physical security department is responsible for controlling all physical access to the facility. This includes implementing measures such as security guards, surveillance systems, access control systems, and visitor management protocols to ensure the safety and security of the premises. They play a crucial role in preventing unauthorized entry, theft, vandalism, and other physical threats to the facility and its occupants.Rate this question:
-
- 6.
The most important issue in forming and managing an incident response team is ________.
- A.
Skill members
- B.
Good employer
- C.
Policy
- D.
High end technology
Correct Answer
C. PolicyExplanation
The most important issue in forming and managing an incident response team is policy. A well-defined and comprehensive policy provides guidelines and procedures for the team to follow in the event of an incident. It ensures that the team members understand their roles and responsibilities, helps in effective decision-making, and promotes consistency in handling incidents. A strong policy also helps in coordinating with other teams, communicating with stakeholders, and maintaining compliance with legal and regulatory requirements. Without a clear policy in place, the incident response team may struggle to effectively respond to and mitigate incidents.Rate this question:
-
- 7.
Which of the below are skills needed to be included in a SCIRT team?
- A.
Cryptography
- B.
Intrusion detection systems
- C.
Documentation creation and maintenance
- D.
Re-assemble PC
- E.
Managerial experience
Correct Answer(s)
A. Cryptography
B. Intrusion detection systems
C. Documentation creation and maintenance
E. Managerial experienceExplanation
The skills needed to be included in a SCIRT team are cryptography, intrusion detection systems, documentation creation and maintenance, and managerial experience. Cryptography is important for ensuring secure communication and data protection. Intrusion detection systems help in identifying and responding to potential security breaches. Documentation creation and maintenance is crucial for keeping track of processes and procedures. Managerial experience is necessary for effective team coordination and decision-making. Re-assembling PCs is not mentioned as a required skill for a SCIRT team.Rate this question:
-
- 8.
CSIRT services that are triggered by an event or request, and are the core component of CSIRT work is called:
- A.
Real-time services
- B.
Active services
- C.
Proactive services
- D.
Reactive services
Correct Answer
D. Reactive servicesExplanation
Reactive services are the correct answer because they are the CSIRT services that are triggered by an event or request. These services are responsive in nature and are designed to react to incidents or issues as they arise. They involve activities such as incident response, incident handling, and incident investigation. Unlike proactive services, which aim to prevent incidents from occurring, reactive services focus on addressing and resolving incidents that have already occurred.Rate this question:
-
- 9.
Users must be knowledgeable not only about basic security practices but also about what constitutes an anomaly or what might be an incident in the making therefore the need for ______________.
- A.
Testing
- B.
Training
- C.
Further study
- D.
Communicating
Correct Answer
B. TrainingExplanation
Users must be knowledgeable not only about basic security practices but also about what constitutes an anomaly or what might be an incident in the making. This knowledge can be gained through training, which provides users with the necessary skills and understanding to identify and respond to potential security threats. Training helps users develop a proactive mindset towards security, enabling them to detect and address anomalies or incidents before they escalate. By undergoing training, users become more equipped to protect themselves and their organization from potential security breaches.Rate this question:
-
- 10.
Which factor is the most important item when it comes to ensuring that security is successful in an organization?
- A.
Effective controls and implementation methods
- B.
Security awareness by all employees
- C.
Updated and relevant security policies and procedures
- D.
Senior management support
Correct Answer
D. Senior management supportExplanation
Senior management support is the most important factor when it comes to ensuring that security is successful in an organization. This is because senior management plays a crucial role in setting the tone and priorities for security within the organization. Their support and commitment to security initiatives are essential for establishing a culture of security awareness and compliance throughout the organization. Without senior management support, it would be difficult to allocate resources, implement effective controls, and enforce security policies and procedures.Rate this question:
-
- 11.
An organization that would like to form an incident response team would have to focus on reasons. What are the reasons?
- A.
To build experts
- B.
Ability to Work Proactively
- C.
Outsourcing
- D.
Rely on constituency
Correct Answer(s)
A. To build experts
B. Ability to Work ProactivelyExplanation
An organization would form an incident response team to build experts and have the ability to work proactively. By building a team of experts, the organization can ensure that they have the necessary skills and knowledge to effectively respond to incidents. Additionally, having the ability to work proactively allows the team to identify and address potential issues before they become major incidents, helping to minimize the impact on the organization.Rate this question:
-
- 12.
A server has been compromised by a hacker who used it to send spam messages to thousands of people on the Internet. A member of the IT staff noticed the problem while monitoring network and service performance over the weekend, and has noticed that several windows are open on the server’s monitor. He also notices that a program he is unfamiliar with is running on the computer. He has called you for instructions as to what he should do next. As the CSIRT team leader, which of the following will you tell him to do immediately?
- A.
Call the police
- B.
Reboot the server to disconnect the hacker from the machine and using the server further
- C.
Document what appears on the screen
- D.
Shut down the server to prevent the hacker from using the server further
Correct Answer
C. Document what appears on the screenExplanation
The IT staff member should document what appears on the screen immediately. This is important because it will provide valuable information about the compromise and help in the investigation process. The open windows and unfamiliar program running on the server may contain clues about the hacker's activities and potential vulnerabilities that were exploited. Documenting this information will assist the CSIRT team in analyzing the incident, identifying the extent of the compromise, and taking appropriate actions to mitigate the attack.Rate this question:
-
- 13.
What has caused the rise in computer crimes and new methods of committing old computer crimes?
- A.
Creation of new software.
- B.
World Wide Web
- C.
New security methods of detecting computer crimes
- D.
Increased use of computer and expansion of the internet and its services
Correct Answer
B. World Wide WebExplanation
The rise in computer crimes and new methods of committing old computer crimes can be attributed to the increased use of computers and the expansion of the internet and its services. The World Wide Web has provided a platform for individuals to connect globally and access information, but it has also opened doors for cybercriminals to exploit vulnerabilities and commit computer crimes. As more people rely on computers and the internet for various activities, the opportunities for cybercriminals to target individuals and organizations have also increased.Rate this question:
-
- 14.
How do users prevent and protect themselves against viruses?
- A.
Missing Files or folders should be deleted
- B.
Do not delete or report SPAM from your computer
- C.
Files with weird and obscene messages should be stored
- D.
Do not open e-mail attachments, use an OS that has virus security features, scan other users’ media storage devices before using them on your computer
Correct Answer
D. Do not open e-mail attachments, use an OS that has virus security features, scan other users’ media storage devices before using them on your computerExplanation
The correct answer is to not open e-mail attachments, use an OS that has virus security features, and scan other users' media storage devices before using them on your computer. This is because opening e-mail attachments can introduce viruses to your computer, using an OS with virus security features can help protect against viruses, and scanning other users' media storage devices can help identify and remove any potential viruses before they can infect your computer.Rate this question:
-
- 15.
Your machine was infected by a particularly destructive virus. Luckily, you have backups of your data. Which of the following should you do first?
- A.
Restore the data from the backups
- B.
Scan the data from the backups for virus infection
- C.
Boot from an anti-virus CD or floppy to scan and disinfect your machine
- D.
Use the installed anti-virus program to scan and disinfect your machine
Correct Answer
D. Use the installed anti-virus program to scan and disinfect your machine -
- 16.
Which group causes the most risk of fraud and computer compromises?
- A.
Hackers
- B.
Contractors / Suppliers
- C.
Employees
- D.
Vendors
Correct Answer
C. EmployeesExplanation
Employees pose the most risk of fraud and computer compromises because they have direct access to sensitive information and systems within an organization. They are familiar with the internal processes and controls, making it easier for them to exploit vulnerabilities or manipulate data for personal gain. Additionally, employees may inadvertently compromise systems through negligence, such as falling victim to phishing attacks or using weak passwords. Therefore, organizations need to implement strong security measures and regularly educate employees about the importance of cybersecurity to mitigate these risks.Rate this question:
-
- 17.
Which element must computer evidence have to be admissible in court?
- A.
It must contain source code
- B.
It must be annotated
- C.
It must be printed
- D.
It must be relevant
Correct Answer
D. It must be relevantExplanation
Computer evidence must be relevant in order to be admissible in court. This means that the evidence must have a direct connection to the case and be able to provide information or support the claims being made. Irrelevant evidence would not be considered admissible as it would not have any bearing on the case at hand. Therefore, for computer evidence to be admissible, it must be relevant to the specific matter being litigated.Rate this question:
-
- 18.
First point to test in the notification process:
- A.
Observing the process
- B.
Straight away conduct test
- C.
Identifying a typical user
- D.
Presenting that user with a form
Correct Answer
C. Identifying a typical userExplanation
The first point to test in the notification process is identifying a typical user. This is important because it allows the tester to select a representative user who will be able to provide valuable feedback on the notification system. By presenting this user with a form, the tester can gather specific information and evaluate the effectiveness of the notification process. Observing the process and conducting tests can come later in the testing process, but identifying a typical user is the initial step.Rate this question:
-
- 19.
Attack tracing can be implemented in the PDCERF methodology such as:
- A.
Containment, eradication, recovery
- B.
Eradication, recovery, follow up
- C.
Detection, containment, eradication
- D.
Planning, detection
Correct Answer
C. Detection, containment, eradicationExplanation
In the PDCERF methodology, attack tracing can be implemented by following the steps of detection, containment, and eradication. First, the attack is detected, which involves identifying any signs or indicators of an attack. Once detected, the next step is containment, which involves isolating and minimizing the impact of the attack to prevent further damage. Finally, eradication is the process of completely removing the attack and its effects from the system. This sequence ensures that the attack is identified, controlled, and eliminated effectively.Rate this question:
-
- 20.
There are 5 common incident prorities. In priority 3, the CSIRT should:
- A.
Protect human lives
- B.
Minimize disruption of computing resources
- C.
Protect classified and / or sensitive data
- D.
Protect important data in the organization
Correct Answer
D. Protect important data in the organizationExplanation
In priority 3, the CSIRT should protect important data in the organization. This means that when an incident occurs, the CSIRT should prioritize the security and integrity of important data within the organization. This could involve implementing measures such as encryption, access controls, and backups to ensure that important data is not compromised or lost during the incident. Protecting important data is crucial for maintaining the confidentiality, availability, and integrity of the organization's information assets.Rate this question:
-
- 21.
What is the main task of a CSIRT?
- A.
I. Provide assistance in preventing and handling computer security incidents
- B.
II. Shares information and lessons learned
- C.
III.A place to report local computer security incident problems
- D.
I & II
- E.
II & III
- F.
All of the above
Correct Answer
F. All of the aboveExplanation
A CSIRT, or Computer Security Incident Response Team, is responsible for multiple tasks. Firstly, it provides assistance in preventing and handling computer security incidents, which involves proactive measures and reactive responses to incidents. Secondly, it shares information and lessons learned with other organizations or teams, contributing to the overall knowledge and improvement of computer security. Lastly, it serves as a place to report local computer security incident problems, acting as a central point for incident reporting and coordination. Therefore, the correct answer is "All of the above" as it encompasses all the main tasks of a CSIRT.Rate this question:
-
- 22.
A CSIRT with a _______________ relationship with it constituency, would be able to advise & influence the constituency.
- A.
Full authority
- B.
Share authority
- C.
No authority
- D.
None of the above
Correct Answer
B. Share authorityExplanation
A CSIRT with a "share authority" relationship with its constituency would be able to advise and influence the constituency. This means that the CSIRT has a level of authority and power that is shared with the constituency, allowing for collaboration and cooperation in decision-making processes. This type of relationship fosters trust and open communication, enabling the CSIRT to effectively provide guidance and influence the actions of the constituency in matters of cybersecurity.Rate this question:
-
- 23.
Why does organizational resistance become a barrier to the success of a CSIRT?
- A.
Feeling threatened
- B.
Overhead function
- C.
Burdened by more tasks
- D.
Reluctant to go for training
Correct Answer
A. Feeling threatenedExplanation
Organizational resistance becomes a barrier to the success of a CSIRT because when employees feel threatened by the establishment of a CSIRT, they may resist its implementation and hinder its effectiveness. This resistance can stem from a fear of change, a perception that the CSIRT threatens their job security or power dynamics within the organization. Such resistance can lead to a lack of cooperation, reluctance to share information, and a failure to fully engage with the CSIRT's activities, ultimately impeding its ability to effectively respond to and mitigate cybersecurity incidents.Rate this question:
-
- 24.
There are many ways to spread the information about the incident response team. Which is first best way to do so?
- A.
Creating a website dedicated for the team
- B.
Send out email to all staffs regarding the setup of the team
- C.
Train and educate the people within the team, especially the help desks
- D.
Get the staffs to remember all the teams' contact number and email
Correct Answer
C. Train and educate the people within the team, especially the help desksExplanation
Training and educating the people within the team, especially the help desks, is the first best way to spread information about the incident response team. By providing proper training and education, team members will have a clear understanding of their roles and responsibilities, as well as the protocols and procedures to follow during incidents. This will ensure that they are well-equipped to handle any incidents that may arise and can effectively communicate the necessary information to others. Additionally, by focusing on educating the help desks, who often interact directly with users, the team can ensure that accurate and consistent information is provided to all staff members.Rate this question:
-
- 25.
Which of the below are important to have in the documentation of the incident?
- A.
Employees questioned and involved
- B.
Cost of repairing the damage
- C.
Expense and time logs
- D.
The date the case will be brought to court
Correct Answer(s)
A. Employees questioned and involved
C. Expense and time logsExplanation
The documentation of an incident should include information about the employees who were questioned and involved in the incident, as this helps in understanding the sequence of events and identifying any potential witnesses or individuals responsible. Additionally, including expense and time logs in the documentation is important as it provides a record of the resources utilized during the incident response and helps in assessing the impact and cost of the incident. However, the cost of repairing the damage and the date the case will be brought to court are not directly relevant to the documentation of the incident.Rate this question:
-
Quiz Review Timeline +
Our quizzes are rigorously reviewed, monitored and continuously updated by our expert board to maintain accuracy, relevance, and timeliness.
-
Current Version
-
Mar 20, 2023Quiz Edited by
ProProfs Editorial Team -
Sep 28, 2011Quiz Created by
Mecheko
- Binary Code Quizzes
- Computer Concept Quizzes
- Computer Essential Quizzes
- Computer Forensics Quizzes
- Computer Hardware Quizzes
- Computer Networking Quizzes
- Computer Parts Quizzes
- Computer Programming Quizzes
- Computer Science Quizzes
- Computer Shortcut Key Quizzes
- Computer Skills Quizzes
- Computer Virus Quizzes
- Cyber Security Quizzes
- Data Quizzes
- Data Security Quizzes
- Hacking Quizzes
- HCI Quizzes
- IT SecurITy Quizzes
- Malware Quizzes
- Microprocessor Quizzes
- Network Quizzes
- Operating System Quizzes
- Phishing Quizzes
- Programming Language Quizzes
- Software Quizzes
Back to top