PECB ISO/IEC 27035 Foundation Exam Practice & Certification Guide case studies
PECB ISO/IEC 27035 Foundation Exam Practice & Certification Guide · Put your knowledge to work in context.
The PECB ISO/IEC 27035 Foundation credential is an entry-level certificate that demonstrates you understand the fundamental methodologies, requirements, and management approach behind information security incident management. PECB's own description states that the training course enables you to learn the basic elements needed to implement an Incident Management Plan and manage information security incidents, and that holders of the certificate have shown they understand the fundamentals. The PECB ISO/IEC 27035 Foundation Exam Practice & Certification Guide case studies are 5 cases and about 2,941 words.
1Premature Incident Classification at a SaaS Provider
At Northwind Analytics, a 400-employee SaaS provider, the SIEM generates an alert: 47 failed SSH login attempts from a single IP address over 12 minutes, followed by one successful login to a service account with read-only access to a staging database. The service account's password is 14 characters and was rotated 30 days ago.
599 words, about 3 min2Ransomware at a Regional Bank: Containment vs. Evidence
A regional bank's endpoint detection system flags ransomware behavior on 14 teller workstations across three branches. The malware encrypts local files and displays a ransom note.
598 words, about 3 min3Lost Tablet with Written PIN at a Hospital
A hospital's IT service desk receives a call from a nurse: a physician's tablet, used to access patient records, was left in a public cafeteria and is missing. The tablet is encrypted and requires a 6-digit PIN, but the physician had written the PIN on a sticky note attached to the tablet case.
590 words, about 3 min4DDoS Attack and Crisis Management Overreach
A European online retailer experiences a distributed denial-of-service (DDoS) attack that degrades its website response time from 200 ms to 8 seconds for 40 minutes. The attack is volumetric (UDP flood) and is mitigated by the ISP's scrubbing center.
574 words, about 3 min5Compromised Web Server: Isolate, Shut Down, or Patch?
A software development company discovers that a public-facing web server has been compromised and is being used to send spam and participate in a botnet. The server hosts a customer portal used by 50,000 users for licensing and downloads.
580 words, about 3 min