Chapter 18 (Lesson 12)

Question 1

1. What are the major categories of computer crime?

Answer 1

1. The major categories of computer crime are
   - military/intelligence attacks,
   - business attacks,
   - financial attacks,
   - terrorist attacks,
   - grudge attacks,
   - thrill attacks.

Question 2

2. What is the main motivation behind a thrill attack?

Answer 2

2. Thrill attacks are motivated by individuals seeking to achieve the “high” associated with successfully breaking into a computer system.

Question 3

3. What is the difference between an interview and an interrogation?

Answer 3

3. Interviews are conducted with the intention of gathering information from individuals to assist with your investigation.
   Interrogations are conducted with the intent of gathering evidence from suspects to be used in a criminal prosecution.

Question 4

4. What is the difference between an event and an incident?

Answer 4

4. An event is any occurrence that takes place during a certain period of time.
   Incidents are events that have negative outcomes affecting the confidentiality, integrity, or availability of your data.

Question 5

5. Who are the common members of an incident response team?

Answer 5

5. Incident response teams normally include representatives from
   senior management,
   information security professionals,
   legal representatives,
   public affairs/communications representatives,
   and technical engineers.

Question 6

6. What are the three phases of the incident response process?

Answer 6

6. The three phases of the incident response process are
7. detection and identification,
8. response and reporting,
9. recovery and remediation.

Question 7

7. What are the three basic requirements that evidence must meet in order to be admissible in court?

Answer 7

7. To be admissible, evidence must be reliable, competent, and material to the case.

Question 8

1. What is a computer crime?

A. Any attack specifically listed in your security policy

B. Any illegal attack that compromises a protected computer

C. Any violation of a law or regulation that involves a computer

D. Failure to practice due diligence in computer security

Answer 8

1. C. A crime is any violation of a law or regulation. The violation stipulation defines the action as a crime. It is a computer crime if the violation involves a computer either as the target or as a tool.

Question 9

2. What is the main purpose of a military and intelligence attack?

A. To attack the availability of military systems

B. To obtain secret and restricted information from military or law enforcement sources

C. To utilize military or intelligence agency systems to attack other nonmilitary sites

D. To compromise military systems for use in attacks against other systems

Answer 9

2. B. A military and intelligence attack is targeted at the classified data that resides on the system. To the attacker, the value of the information justifies the risk associated with such an attack. The information extracted from this type of attack is often used to plan subsequent attacks.

Question 10

3. What type of attack targets proprietary information stored on a civilian organization’s system?

A. Business attack

B. Denial-of-service attack

C. Financial attack

D. Military and intelligence attack

Answer 10

3. A. Confidential information that is not related to the military or intelligence agencies is the target of business attacks. The ultimate goal could be destruction, alteration, or disclosure of confidential information.

Question 11

4. What goal is not a purpose of a financial attack?

A. Access services you have not purchased

B. Disclose confidential personal employee information

C. Transfer funds from an unapproved source into your account

D. Steal money from another organization

Answer 11

4. B. A financial attack focuses primarily on obtaining services and funds illegally.

Question 12

5. Which one of the following attacks is most indicative of a terrorist attack?

A. Altering sensitive trade secret documents

B. Damaging the ability to communicate and respond to a physical attack

C. Stealing unclassified information

D. Transferring funds to other countries

Answer 12

5. B. A terrorist attack is launched to interfere with a way of life by creating an atmosphere of fear. A computer terrorist attack can reach this goal by reducing the ability to respond to a simultaneous physical attack.

Question 13

6. Which of the following would not be a primary goal of a grudge attack?

A. Disclosing embarrassing personal information

B. Launching a virus on an organization’s system

C. Sending inappropriate email with a spoofed origination address of the victim organization

D. Using automated tools to scan the organization’s systems for vulnerable ports

Answer 13

6. D. Any action that can harm a person or organization, either directly or through embarrassment, would be a valid goal of a grudge attack. The purpose of such an attack is to “get back” at someone.

Question 14

7. What are the primary reasons attackers engage in thrill attacks? (Choose all that apply.)

A. Bragging rights

B. Money from the sale of stolen documents

C. Pride of conquering a secure system

D. Retaliation against a person or organization

Answer 14

7. A, C. Thrill attacks have no reward other than providing a boost to pride and ego. The thrill of launching the attack comes from the act of participating in the attack (and not getting caught).

Question 15

8. What is the most important rule to follow when collecting evidence?

A. Do not turn off a computer until you photograph the screen.

B. List all people present while collecting evidence.

C. Never modify evidence during the collection process.

D. Transfer all equipment to a secure storage location.

Answer 15

8. C. Although the other options have some merit in individual cases, the most important rule is to never modify, or taint, evidence. If you modify evidence, it becomes inadmissible in court.

Question 16

9. What would be a valid argument for not immediately removing power from a machine when an incident is discovered?

A. All of the damage has been done. Turning the machine off would not stop additional damage.

B. There is no other system that can replace this one if it is turned off.

C. Too many users are logged in and using the system.

D. Valuable evidence in memory will be lost.

Answer 16

9. D. The most compelling reason for not removing power from a machine is that you will lose the contents of memory. Carefully consider the pros and cons of removing power. After all is considered, it may be the best choice.

Question 17

10. Hacktivists are motivated by which of the following factors? (Choose all that apply.)

A. Financial gain

B. Thrill

C. Skill

D. Political beliefs

Answer 17

10. B, D. Hacktivists (the word is a combination of hacker and activist) often combine political motivations with the thrill of hacking. They organize themselves loosely into groups with names like Anonymous and Lolzsec and use tools like the Low Orbit Ion Cannon to create large-scale denial-of-service attacks with little knowledge required.

Question 18

11. What is an incident?

A. Any active attack that causes damage to your system

B. Any violation of a code of ethics

C. Any crime (or violation of a law or regulation) that involves a computer

D. Any event that adversely affects the confidentiality, integrity, or availability of your data

Answer 18

11. D. An incident is normally defined as any event that adversely affects the confidentiality, integrity, or availability of your data.

Question 19

12. If port scanning does no damage to a system, why is it generally considered an incident?

A. All port scans indicate adversarial behavior.

B. Port scans can precede attacks that cause damage and can indicate a future attack.

C. Scanning a port damages the port.

D. Port scanning uses system resources that could be put to better uses.

Answer 19

12. B. Some port scans are normal. An unusually high volume of port scan activity can be a reconnaissance activity preceding a more dangerous attack. When you see unusual port scanning, you should always investigate.

Question 20

13. What type of incident is characterized by obtaining an increased level of privilege?

A. Compromise

B. Denial of service

C. Malicious code

D. Scanning

Answer 20

13. A. Any time an attacker exceeds their authority, the incident is classified as a system compromise. This includes valid users who exceed their authority as well as invalid users who gain access through the use of a valid user ID.

Question 21

14. What is the best way to recognize abnormal and suspicious behavior on your system?

A. Be aware of the newest attacks.

B. Configure your IDS to detect and report all abnormal traffic.

C. Know what your normal system activity looks like.

D. Study the activity signatures of the main types of attacks.

Answer 21

14. C. Although options A, B, and D are actions that can make you aware of what attacks look like and how to detect them, you will never successfully detect most attacks until you know your system. When you know what the activity on your system looks like on a normal day, you can immediately detect any abnormal activity.

Question 22

15. If you need to confiscate a PC from a suspected attacker who does not work for your organization, what legal avenue is most appropriate?

A. Consent agreement signed by employees

B. Search warrant

C. No legal avenue is necessary.

D. Voluntary consent

Answer 22

15. B. In this case, you need a search warrant to confiscate equipment without giving the suspect time to destroy evidence. If the suspect worked for your organization and you had all employees sign consent agreements, you could simply confiscate the equipment.

Question 23

16. Why should you avoid deleting log files on a daily basis?

A. An incident may not be discovered for several days and valuable evidence could be lost.

B. Disk space is cheap, and log files are used frequently.

C. Log files are protected and cannot be altered.

D. Any information in a log file is useless after it is several hours old.

Answer 23

16. A. Log files contain a large volume of generally useless information. However, when you are trying to track down a problem or an incident, they can be invaluable. Even if an incident is discovered as it is happening, it may have been preceded by other incidents. Log files provide valuable clues and should be protected and archived.

Question 24

17. Which of the following conditions might require that you report an incident? (Choose all that apply.)

A. Confidential information protected by government regulation was possibly disclosed.

B. Damages exceeded $1,500.

C. The incident has occurred before.

D. The incident resulted in a violation of a law

Answer 24

17. A, D. You must report an incident when the incident resulted in the violation of a law or regulation. This includes any damage (or potential damage) to or disclosure of protected information.

Question 25

18. What are ethics? A. Mandatory actions required to fulfill job requirements B. Laws of professional conduct C. Regulations set forth by a professional organization D. Rules of personal behavior

Answer 25

18. D. Ethics are simply rules of personal behavior. Many professional organizations establish formal codes of ethics to govern their members, but ethics are personal rules individuals use to guide their lives.

Question 26

19. According to the (ISC)2 Code of Ethics, how are CISSPs expected to act? A. Honestly, diligently, responsibly, and legally B. Honorably, honestly, justly, responsibly, and legally C. Upholding the security policy and protecting the organization D. Trustworthy, loyally, friendly, courteously

Answer 26

19. B. The second canon of the (ISC)2 Code of Ethics states how a CISSP should act, which is honorably, honestly, justly, responsibly, and legally.

Question 27

20. Which of the following actions are considered unacceptable and unethical according to RFC 1087, “Ethics and the Internet”? A. Actions that compromise the privacy of classified information B. Actions that compromise the privacy of users C. Actions that disrupt organizational activities D. Actions in which a computer is used in a manner inconsistent with a stated security policy

Answer 27

20. B. RFC 1087 does not specifically address the statements in A, C, or D. Although each type of activity listed is unacceptable, only “actions that compromise the privacy of users” are explicitly identified in RFC 1087.