Outcomes addressed in this activity:

Unit Outcomes:

  • Break apart incident response.
  • Choose preventative measures.
  • Examine logging, monitoring, and auditing.

Course Outcome:

IT410-4: Determine incident prevention and response strategies.

Purpose

In this assignment, you will examine various incident response steps such as incident detection, investigating alerts, incident mitigation, and recovery.

Assignment Instructions

Answer the following 12 questions by selecting the single best answer for each. Using your course materials and/or other credible resources, provide a 50- to 100-word explanation of why you chose your answer for each question. Please cite your sources for your answers from your course materials or other credible resources.

  1. Your company has implemented a host-based intrusion detection system (HIDS). You have recently become concerned with problems when these systems are implemented. What is a major problem when deploying this type of system?
    1. It is hard to discover the files that have been altered by an attack.
    2. It must be deployed on each computer that needs it.
    3. All incoming network traffic to the host is monitored.
  2. During a recent security audit of your company’s network, contractors suggested that the operating systems on client computers are not sufficiently hardened. Which steps are crucial to ensure that an operating system is hardened?
    1. Disable unnecessary services.
    2. Install appropriate monitoring software.
    3. Install appropriate administrative tools.
  3. During a recent incident investigation, you extracted hidden data from the data image that was created. In which step of the incident investigation process were you involved?
    1. preservation
    2. collection
    3. examination
  4. Which U.S. government entity is responsible for dealing with federal computer security incidents that occur in civilian agencies?
    1. Federal Computer Incident Response Center (FedCIRC)
    2. Secret Service
    3. Federal Bureau of Investigation (FBI)
  5. Match the best description (number) on the second table with the type of intrusion detection system (IDS) on the first table (letter).
ABehavior-based 
BSignature-based 
CHost-based 
DNetwork-based 
1an IDS that maintains an attack profile database to identify intrusion attempts
2an IDS that monitors an entire network segment for intrusion attempts
3an IDS that only monitors a single particular device for intrusion attempts
4an IDS that uses a learned activity baseline to identify intrusion attempts
  1. Match the best description (number) on the second table with the malware type on the first table (letter). 
AAdware 
BBotnet 
CRootkit 
DWorm 
1a computer that is hacked when a malicious program is installed on it and remotely triggered
2a program that spreads itself through network connections
3a software application that displays advertisements while the application is executing
4a collection of programs that grants a hacker administrative access to a computer or network
  1. As part of your organization’s security policy, you must monitor access control violations. Which method(s) should you use?
    1. ACLs
    2. IDSs
    3. backups
    4. audit logs
      1. option a
      2. option b
      3. option c
      4. option d
      5. options b and d
      6. options b, c, and d
      7. all of the options
  2. You have decided to utilize a host-based intrusion detection system (HIDS) to provide added security on your company’s network. Which sources of information are not utilized by this system to analyze an intrusion attempt?
    1. system logs
    2. network packets
    3. operating system alarms
    4. operating system audit trails
      1. option a
      2. option b
      3. option c
      4. option d
      5. options a and b
  3. Which of the following security mechanisms is most effective in protecting rent disclosure and transmission outside the organization’s network?
    1. safeguards over keys
    2. configuration of firewalls
    3. authentication within application
  4. The most important reason that statistical anomaly-based intrusion detection systems (stat IDSs) are less commonly used than signature-based IDSs is that stat IDSs:
    1. create more overhead than signature-based ideas
    2. generate false alarms from varying user or system actions
    3. cause false positives from minor changes to system variables
  5. Which of the following is the most relevant metric to include in any information security quarterly report to the executive committee?
    1. percentage of security compliance servers
    2. security compliant servers trend report
    3. number of security patches applied
  6. Why is it important to develop an information security baseline? The security baseline helps define:
    1. a security policy for the entire organization
    2. a critical information resource that is needing protection
    3. the minimum acceptable security to be implemented

Assignment Requirements

Only the title page, in-text citations, and reference page are required to be formatted according to APA standards for this assignment.

All papers are written by ENL (US, UK, AUSTRALIA) writers with vast experience in the field. We perform a quality assessment on all orders before submitting them.

Do you have an urgent order?  We have more than enough writers who will ensure that your order is delivered on time. 

We provide plagiarism reports for all our custom written papers. All papers are written from scratch.

24/7 Customer Support

Contact us anytime, any day, via any means if you need any help. You can use the Live Chat, email, or our provided phone number anytime.

We will not disclose the nature of our services or any information you provide to a third party.

Assignment Help Services
Money-Back Guarantee

Get your money back if your paper is not delivered on time or if your instructions are not followed.

We Guarantee the Best Grades
Assignment Help Services