Start learning →

Knock out the false precursor lines

Exercise and reference answers

Questions
  1. Question
    Three of these lines about a precursor are false.
    Choices
    1. Item
      A sign an incident may occur in future
      Correct
      Yes
    2. Explanation
      That is an indicator, which points at now or the recent past.
      Item
      A sign an incident is happening now
    3. Explanation
      That is a false positive, a judgement about the accuracy of an alert.
      Item
      An alert that turns out to be wrong
    4. Explanation
      That is a network flow, a source of signs rather than a sign.
      Item
      A communication session between hosts
  2. Question
    Three of these lines about precursors and indicators are false.
    Choices
    1. Item
      Precursors are rare, indicators common
      Correct
      Yes
    2. Explanation
      Most attacks carry no identifiable or detectable precursor.
      Item
      Most attacks show a clear precursor
    3. Explanation
      Sensors can raise thousands of alerts in a single day.
      Item
      Indicators arrive a few times a year
    4. Explanation
      One points forward in time, the other at now or the recent past.
      Item
      Precursor and indicator mean the same
Instructions
Tap the three wrong lines in each set about signs of an incident, leaving the true one standing.

Explanation

_Source: NIST SP 800-61 Rev. 2 "Computer Security Incident Handling Guide" (Aug 2012), section 3.2.2 "Signs of an Incident"_
Continue learning with Quill →

Browse more BCA Cyber Security questions and exercises →