ExamGecko
Question list
Search
Search

Question 278 - CISM discussion

Report
Export

Which of the following is the BEST course of action when an online company discovers a network attack in progress?

A.
Dump all event logs to removable media
Answers
A.
Dump all event logs to removable media
B.
Isolate the affected network segment
Answers
B.
Isolate the affected network segment
C.
Enable trace logging on ail events
Answers
C.
Enable trace logging on ail events
D.
Shut off all network access points
Answers
D.
Shut off all network access points
Suggested answer: B

Explanation:

The BEST course of action when an online company discovers a network attack in progress is to isolate the affected network segment. This prevents the attacker from gaining further access to the network and limits the scope of the attack. Dumping event logs to removable media and enabling trace logging may be useful for forensic purposes, but should not be the first course of action in the midst of an active attack. Shutting off all network access points would be too drastic and would prevent legitimate traffic from accessing the network.

asked 01/10/2024
Tarun Sharma
45 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first