English
Menu

Cyber Attacks and Defense in Practice

Which of the following correctly describes the difference in roles between a CSIRT and a PSIRT set up within an organization?

  1. AA CSIRT responds to incidents in the organization's own systems, and a PSIRT responds to vulnerabilities in the company's products
  2. BA CSIRT handles only vulnerabilities in products and is not involved in incidents that occur in the organization's own information systems
  3. CPSIRT is the name for an external group of attackers, and CSIRT is the name for the organization that is attacked by them
Show answer and explanation

Answer: A. A CSIRT responds to incidents in the organization's own systems, and a PSIRT responds to vulnerabilities in the company's products

A CSIRT (computer security incident response team) is the team that receives and analyzes security incidents in the organization's systems, coordinates the response and liaises with external bodies. A PSIRT (product security incident response team) receives reports from outside researchers and others about vulnerabilities in the products and services the company provides, and drives the development of fixes, disclosure to users and distribution of the fixes. Organizations that ship products, such as device and semiconductor manufacturers, set up both and have them work together.

  • A. Correct. The CSIRT protects the organization's own systems, and the PSIRT handles vulnerabilities in shipped products.
  • B. It is mainly the PSIRT that handles vulnerabilities in products.
  • C. Both are defensive teams.
Practice this topic Back to topic

Books on Cyber Attacks and Defense in Practice Ad

As an Amazon Associate I earn from qualifying purchases.

More Cyber Attacks and Defense in Practice questions

  1. The logs of two servers are being compared in an intrusion investigation. The web server logs in Coordinated Universal Time (UTC), and its clock was set correctly by NTP. The file server logs in Japan time (UTC+9 hours), and its clock was 4 minutes ahead of the correct time. The web server log records a suspicious login at 01:52 (UTC), and the file server log records a mass read of files at 10:58 (Japan time). How many minutes after the suspicious login did the file reads actually happen?
  2. In the same week, fixes were released for three vulnerabilities. The operations staff can apply only one fix per day. Which of the following is the most appropriate combination of the fix to apply first and the reason?
  3. Which of the following correctly describes the differences between vulnerability scanning, penetration testing and red team exercises as ways of checking an organization's defenses?
  4. An outside security researcher has found an undisclosed vulnerability in a company's product. Which of the following is the most appropriate way to proceed according to the idea of coordinated vulnerability disclosure?
  5. Which of the following is the main purpose of creating and maintaining an SBOM (software bill of materials)?

Comparisons in this topic