OpenCyber AcademyLesson map
Lesson 19. Map, example, EX065.
flowchart TD
B["Backups already existed"] --> R["Recover was the only CSF part in place"]
L["Leo's next test"] --> F["Restore one client folder"]
F --> Q{"Does the book print a pass or a time?"}
Q -->|No| K["The test stays a plan"]
A planned restore is not a sixth signal and not a score.
Logical drawing
CSF before the incident
Protect, Detect, Respond: empty
Recover: backups already in place
planned test: one client folder
printed score: none
signals: still four
Learning outcomes
After this chapter, you should be able to:
- Say which CSF part existed before the incident.
- Keep the folder restore as a plan.
- Refuse a fifth signal or a D3FEND score.
19.1 The restore is the next subject. This book does not grade it.
Before the incident, Protect, Detect, and Respond were empty. Backups, for Recover, were the only CSF part already in place. Leo's next topic is incident response and resilience. He would test the backups by restoring one client folder and asking whether the accounts software and client files could come back quickly. "Quickly" is not given a minute count in this book. The restore is not recorded as passed or failed. One folder is not every client folder, and it is not a resilience score.
The four signals stay four. A restore test does not watch a mailbox. Adding it as a fifth signal would mix Recover with Detect. D3FEND (Kaloroumakis and Smith, 2021) is a knowledge graph of countermeasures. This book names it and does not score a countermeasure identifier against the folder. No second script prints a restore result.
Incident response would also turn the mailbox playbook into short playbooks for other events, such as a lost laptop or a ransomware note. Those playbooks are not written here. The next course is where that work continues. This chapter does not invent their steps.
Lesson table; scroll horizontally to read all columns →
| Item | Status in this book |
|---|---|
| Backups before the incident | Already in place |
| One client folder | A planned test |
| Pass, fail, or duration | Not printed |
| Fifth signal | Not added |
| D3FEND identifier | Not scored |
19.2 Worked example
Lesson table; scroll horizontally to read all columns →
| Offered conclusion | What the book actually has | Decision |
|---|---|---|
| "Recover was the part already in place." | Backups existed | Keep |
| "The test Leo plans is one folder." | A plan, not a result | Keep |
| "The restore passed in four minutes." | No duration is printed | Refuse |
| "Folder restore is signal number five." | The signals stay four | Refuse |
Synthetic case. No restore log is embedded.
Errors and limits
Do not print a pass mark for a test this book does not run.
Apply
- EX065 — One folder. Which CSF part was already in place, what does Leo plan to restore, and why is that plan not a score or a fifth signal?
Show marking criteria
Rubric: 3 = backups, for Recover, were already in place; he plans to restore one client folder; no pass, fail, or duration is printed; the four signals stay four;; 2 = the plan stays a plan and the signals stay four;; 1 = one fact;; 0 = none.