212-89 Practice Test

Incident handling and response steps help you to detect, identify, respond and manage an incident. Which of
the following steps focus on limiting the scope and extent of an incident?

A.

Eradication

B.

Containment

C.

Identification

D.

Data collection

Computer Forensics is the branch of forensic science in which legal evidence is found in any computer or any
digital media device. Of the following, who is responsible for examining the evidence acquired and separating
the useful evidence?

A.

Evidence Supervisor

B.

Evidence Documenter

C.

Evidence Manager

D.

Evidence Examiner/ Investigator

The process of rebuilding and restoring the computer systems affected by an incident to normal operational
stage including all the processes, policies and tools is known as:

A.

Incident Management

B.

Incident Response

C.

Incident Recovery

D.

Incident Handling

Incident Response Plan requires

A.

Financial and Management support

B.

Expert team composition

C.

Resources

D.

All the above

The typical correct sequence of activities used by CSIRT when handling a case is:

A.

Log, inform, maintain contacts, release information, follow up and reporting

B.

Log, inform, release information, maintain contacts, follow up and reporting

C.

Log, maintain contacts, inform, release information, follow up and reporting

D.

Log, maintain contacts, release information, inform, follow up and reporting