ExamGecko
Question list
Search
Search

List of questions

Search

Related questions











Question 41 - 212-82 discussion

Report
Export

The IH&R team in an organization was handling a recent malware attack on one of the hosts connected to the organization's network. Edwin, a member of the IH&R team, was involved in reinstating lost data from the backup medi a. Before performing this step, Edwin ensured that the backup does not have any traces of malware.

Identify the IH&R step performed by Edwin in the above scenario.

A.
Eradication
Answers
A.
Eradication
B.
Incident containment
Answers
B.
Incident containment
C.
Notification
Answers
C.
Notification
D.
Recovery
Answers
D.
Recovery
Suggested answer: D

Explanation:

Recovery is the IH&R step performed by Edwin in the above scenario. IH&R (Incident Handling and

Response) is a process that involves identifying, analyzing, containing, eradicating, recovering from, and reporting on security incidents that affect an organization's network or system. Recovery is the IH&R step that involves restoring the normal operation of the system or network after eradicating the incident. Recovery can include reinstating lost data from the backup media, applying patches or updates, reconfiguring settings, testing functionality, etc. Recovery also involves ensuring that the backup does not have any traces of malware or compromise . Eradication is the IH&R step that involves removing all traces of the incident from the system or network, such as malware, backdoors, compromised files, etc. Incident containment is the IH&R step that involves implementing appropriate measures to stop the infection from spreading to other organizational assets and to prevent further damage to the organization. Notification is the IH&R step that involves informing relevant stakeholders, authorities, or customers about the incident and its impact.

asked 18/09/2024
Thiago B
43 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first