Which test is conducted to determine the incident recovery procedures effectiveness?

Which of the following may be considered as insider threat(s):

The sign(s) of the presence of malicious code on a host infected by a virus which is delivered via e-mail could
be:

Contingency planning enables organizations to develop and maintain effective methods to handle
emergencies. Every organization will have its own specific requirements that the planning should address.
There are five major components of the IT contingency plan, namely supporting information, notification
activation, recovery and reconstitution and plan appendices. What is the main purpose of the reconstitution
plan?

What command does a Digital Forensic Examiner use to display the list of all open ports and the associated IP
addresses on a victim computer to identify the established connections on it: