Information Security Management Examination (SG) | Section B Incidents and Supplier Management 02
1 / 100.0s
Problem 1 ・ Question 1 / 10
An accounts clerk at Company B, a manufacturer, opened an attachment to a mail purporting to come from a business partner. Immediately afterwards the device slowed down and suspicious traffic to the outside was detected. Payment data that has not yet been sent is stored on the device. The mail system and device management are outsourced to an external IT company. Company B's CSIRT has begun to respond.
What is the appropriate first action for the clerk to take?
View explanation
Isolate the device to limit the spread of damage and report promptly in accordance with the procedure.
Problem 1 ・ Question 2 / 10
An accounts clerk at Company B, a manufacturer, opened an attachment to a mail purporting to come from a business partner. Immediately afterwards the device slowed down and suspicious traffic to the outside was detected. Payment data that has not yet been sent is stored on the device. The mail system and device management are outsourced to an external IT company. Company B's CSIRT has begun to respond.
Which information should the CSIRT preserve in its first response?
View explanation
Preserve, without altering it, the evidence needed to investigate the cause and the extent of the impact.
Problem 1 ・ Question 3 / 10
An accounts clerk at Company B, a manufacturer, opened an attachment to a mail purporting to come from a business partner. Immediately afterwards the device slowed down and suspicious traffic to the outside was detected. Payment data that has not yet been sent is stored on the device. The mail system and device management are outsourced to an external IT company. Company B's CSIRT has begun to respond.
How should employees who received a similar mail be handled?
View explanation
Share information such as the indicators of compromise and tell people not to open the attachment but to report it.
Problem 1 ・ Question 4 / 10
An accounts clerk at Company B, a manufacturer, opened an attachment to a mail purporting to come from a business partner. Immediately afterwards the device slowed down and suspicious traffic to the outside was detected. Payment data that has not yet been sent is stored on the device. The mail system and device management are outsourced to an external IT company. Company B's CSIRT has begun to respond.
How can the integrity of the payment data be confirmed?
View explanation
Compare it against trustworthy records to confirm whether it has been altered improperly.
Problem 1 ・ Question 5 / 10
An accounts clerk at Company B, a manufacturer, opened an attachment to a mail purporting to come from a business partner. Immediately afterwards the device slowed down and suspicious traffic to the outside was detected. Payment data that has not yet been sent is stored on the device. The mail system and device management are outsourced to an external IT company. Company B's CSIRT has begun to respond.
What should be confirmed with the subcontractor straight away?
View explanation
Prevent the loss of logs needed for the investigation and confirm the extent of the damage quickly.
Problem 1 ・ Question 6 / 10
An accounts clerk at Company B, a manufacturer, opened an attachment to a mail purporting to come from a business partner. Immediately afterwards the device slowed down and suspicious traffic to the outside was detected. Payment data that has not yet been sent is stored on the device. The mail system and device management are outsourced to an external IT company. Company B's CSIRT has begun to respond.
What is the problem with wiping the infected device before the investigation of the cause is complete?
View explanation
Wiping the device before the evidence is preserved makes it hard to analyse the route of intrusion and the extent of the impact.
Problem 1 ・ Question 7 / 10
An accounts clerk at Company B, a manufacturer, opened an attachment to a mail purporting to come from a business partner. Immediately afterwards the device slowed down and suspicious traffic to the outside was detected. Payment data that has not yet been sent is stored on the device. The mail system and device management are outsourced to an external IT company. Company B's CSIRT has begun to respond.
What must be confirmed before restoring service?
View explanation
Restore only after removing the cause, putting measures against reinfection in place and confirming that things are safe.
Problem 1 ・ Question 8 / 10
An accounts clerk at Company B, a manufacturer, opened an attachment to a mail purporting to come from a business partner. Immediately afterwards the device slowed down and suspicious traffic to the outside was detected. Payment data that has not yet been sent is stored on the device. The mail system and device management are outsourced to an external IT company. Company B's CSIRT has begun to respond.
Which drill is effective in guarding against mail that pretends to come from a business partner?
View explanation
Simulated mail and reporting drills build skill in recognising such mail and responding at once.
Problem 1 ・ Question 9 / 10
An accounts clerk at Company B, a manufacturer, opened an attachment to a mail purporting to come from a business partner. Immediately afterwards the device slowed down and suspicious traffic to the outside was detected. Payment data that has not yet been sent is stored on the device. The mail system and device management are outsourced to an external IT company. Company B's CSIRT has begun to respond.
Which contract clause improves the management of subcontractors?
View explanation
Set out management conditions such as reporting, cooperation, audit and further subcontracting clearly in the contract.
Problem 1 ・ Question 10 / 10
An accounts clerk at Company B, a manufacturer, opened an attachment to a mail purporting to come from a business partner. Immediately afterwards the device slowed down and suspicious traffic to the outside was detected. Payment data that has not yet been sent is stored on the device. The mail system and device management are outsourced to an external IT company. Company B's CSIRT has begun to respond.
What should be done once the response has finished?
View explanation
Feeding the lessons into the procedures and controls prevents recurrence and improves the ability to respond.
Result
More sets in this exam
- Information Security Management Examination (SG) | Section A Security Fundamentals 01
- Information Security Management Examination (SG) | Section A Threats and Attack Techniques 02
- Information Security Management Examination (SG) | Section A Cryptography, Authentication and Controls 03
- Information Security Management Examination (SG) | Section A Security Management and Law 04
- Information Security Management Examination (SG) | Section A Risk and Access Management 05
- Information Security Management Examination (SG) | Section A Attack Mitigation and Business Continuity 06