ExamGecko
Question list
Search
Search

Question 190 - CISM discussion

Report
Export

Following a successful attack, an information security manager should be confident the malware @ continued to spread at the completion of which incident response phase?

A.
Containment
Answers
A.
Containment
B.
Recovery
Answers
B.
Recovery
C.
Eradication
Answers
C.
Eradication
D.
Identification
Answers
D.
Identification
Suggested answer: A

Explanation:

According to the CISM Review Manual (Digital Version), page 212, the incident response process consists of six phases: preparation, identification, containment, eradication, recovery, and lessons learned. Containment is the phase where the incident response team isolates the affected systems or networks to prevent further damage or spread of the malware. Eradication is the phase where the incident response team removes the malware and any traces of its activity from the affected systems or networks. Recovery is the phase where the incident response team restores the normal operations of the systems or networks. Identification is the phase where the incident response team detects and analyzes the signs of the incident.Therefore, the information security manager should be confident that the malware has not continued to spread at the completion of the containment phase, which is the earliest phase where the incident response team can stop the propagation of the malware.Reference=1: CISM Review Manual (Digital Version), page 212

asked 01/10/2024
Ivan Galir
47 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first