Which type of control is concerned with restoring controls?

In the course of responding to and handling an incident, you work on determining the root cause of the incident.
In which step are you in?

When referring to a computer crime investigation, which of the following would be the MOST important step
required in order to preserve and maintain a proper chain of custody of evidence:

Who is responsible for initiating corrective measures and capabilities used when there are security violations?

Another example of Computer Incident Response Team (CIRT) activities is:

The exact requirements for the admissibility of evidence vary across legal systems and between different cases
(e.g., criminal versus tort). At a more generic level, evidence should have some probative value, be relevant to
the case at hand, and meet the following criteria which are often called the five rules of evidence:

Which of the following questions is LESS likely to help in assessing controls over hardware and software
maintenance?

Which of the following is NOT a preventive operational control?

Which element must computer evidence have to be admissible in court?

According to the Orange Book, which security level is the first to require a system to support separate operator
and system administrator roles?