Isolation and containment measures lor a compromised computer has been taken and information security
management is now investigating. What is the MOST appropriate next step?

When properly tested, which of the following would MOST effectively support an information security manager
in handling a security breach?

Which of the following would represent a violation of the chain of custody when a backup tape has been
identified as evidence in a fraud investigation? The tape was:

The PRIMARY purpose of performing an internal attack and penetration test as part of an incident response
program is to identify:

A computer incident response team (CIRT) manual should PRIMARILY contain which of the following
documents?

Which of the following application systems should have the shortest recovery time objective (RTO)?

Which of the following is MOST closely associated with a business continuity program?

When performing a business impact analysis (BIA), which of the following should calculate the recovery time
and cost estimates?

Which of the following is the MOST serious exposure of automatically updating virus signature files on every
desktop each Friday at 11:00 p.m. (23.00 hrs.)?

Which of the following are the MOST important criteria when selecting virus protection software?