600-199 Exam Questions

What does the acronym "CSIRT" stand for?

Which publication from the ISO covers security incident response?

As a part of incident response, which action should be performed?

Which action is recommended to prevent an incident from spreading?

What is the most important reason for documenting an incident?

Which three tools should be used for incident response? (Choose three.)

In what sequence do the proper eradicate/recovery steps take place? 1) Re-image 2) Restore 3) Patch 4) Backup

Which four tools are used during an incident to collect data? (Choose four.)

Which type of Layer 2 attack causes a switch to flood all incoming traffic to all ports?

Which two options are advantages of an application layer firewall? (Choose two.)