Please be comprehensive and answer the review questions completely.:1. What is an incident damage assessment?2. What are some of the reasons a safeguard or control may not have been successful in stop

Please be comprehensive and answer the review questions completely.:

1. What is an incident damage assessment?

2. What are some of the reasons a safeguard or control may not have been successful in stopping or limiting an incident?

3. What must be done with interrupted services during the recovery process? 

4. What procedures should occur on a regular basis to maintain the IR plan? 

5. What is digital forensics? 

6. What guides an organization in setting up a forensic capability?

7. How do organizations often divvy up the practice of digital forensics? 

8. What are the common roles and duties of a digital forensic first-response team? 

9. What factors determine which digital evidence should be collected and in what order?

10. In forensic analysis, what are the differences between examination and analysis?

11. Why are the DR activity groups presented out of sequence (during, after, before) instead of in chronological order?

12. What are the major activities planned to occur during the disaster?

13. What are the major activities planned to occur after the disaster?

14. What are the major activities planned to occur before the disaster?

15. What is a DR plan addendum, and why will one or more of them be prepared?

16. What is a DR after-action review (AAR), and what are the primary outcomes from it?

17. According to NIST SP 800-34, what two perspectives should be used to plan a system recovery strategy?

18. What are the elements used in the sample DR plan offered by this chapter?

19. What are the advantages of combining the DR and BC plans? What are the disadvantages?

20. Why should DR planning documents be classified as confidential and have their distribution tightly controlled?