100-160 Question 264
Select 3Your organization has detected unusual traffic that may indicate a cybersecurity incident. According to the NIST Incident Response Lifecycle, which of the following actions should be prioritized during the 'Containment, Eradication, and Recovery' stage?
- A
Isolate the affected systems to prevent further damage.
- B
Determine the root cause of the incident.
- C
Perform a post-incident review to identify lessons learned.
- D
Restore affected systems to normal operations.
- E
Analyze logs to confirm the scope of the incident.
Show answer and explanation
Correct answers: A, B, D
Explanation
The 'Containment, Eradication, and Recovery' stage focuses on limiting the damage caused by the incident (containment), removing the threat (eradication), and restoring systems to their normal state (recovery). Actions such as isolating systems, identifying the root cause, and restoring operations are critical during this stage. Other tasks, like post-incident reviews, occur in later stages of the incident response lifecycle.
- A. Correct.
Correct: Isolating affected systems is a key step in the containment process to prevent the incident from spreading further.
- B. Correct.
Correct: Determining the root cause helps ensure proper eradication of the threat and reduces the risk of reinfection.
- C. Incorrect.
Incorrect: A post-incident review is part of the 'Post-Incident Activity' stage, not the 'Containment, Eradication, and Recovery' stage.
- D. Correct.
Correct: Restoring systems to normal operations is part of the recovery process in this stage.
- E. Incorrect.
Incorrect: Analyzing logs is primarily part of the 'Detection and Analysis' stage to understand the scope of the incident.