300-215 Question 8
Select 3While conducting a root cause analysis (RCA) following a ransomware attack, you are tasked with preparing the RCA report using Cisco Secure Network Analytics (formerly Stealthwatch). Which of the following components are essential to include in your root cause analysis report to ensure it is comprehensive and actionable?
- A
Timeline of events leading up to and during the incident
- B
Detailed list of all security tools deployed in the organization
- C
Identification of the initial attack vector
- D
Remediation steps taken during the incident response
- E
Evaluation of the organization's compliance posture
Show answer and explanation
Correct answers: A, C, D
Explanation
A comprehensive root cause analysis report should focus on the timeline of events to provide context, identify the initial attack vector to uncover vulnerabilities, and document remediation steps to ensure lessons are learned. These components collectively help organizations prevent similar incidents in the future. While other information, such as a list of security tools or overall compliance posture, may be useful for other purposes, they are not essential to the RCA report.
- A. Correct.
A timeline of events is critical for understanding the sequence of actions taken by the attacker and the response team. It provides context for the incident and is a foundational component of an RCA report.
- B. Incorrect.
While listing all security tools in the organization may provide some insights, it is not essential for an RCA report. The focus should be on the tools directly involved in detecting and responding to the incident.
- C. Correct.
Identifying the initial attack vector is a key component of an RCA as it reveals how the attacker gained entry and highlights potential vulnerabilities that need to be addressed.
- D. Correct.
The remediation steps taken are necessary to document how the incident was contained and resolved, ensuring that lessons can be learned for future incidents.
- E. Incorrect.
While evaluating compliance posture is important for overall security, it is not directly relevant to the root cause analysis of a specific incident and does not help in identifying or addressing the root cause.