ExamGecko
Question list
Search
Search

Question 356 - CISM discussion

Report
Export

An employee clicked on a link in a phishing email, triggering a ransomware attack Which of the following should be the information security?

A.
Wipe the affected system.
Answers
A.
Wipe the affected system.
B.
Notify internal legal counsel.
Answers
B.
Notify internal legal counsel.
C.
Notify senior management.
Answers
C.
Notify senior management.
D.
Isolate the impacted endpoints.
Answers
D.
Isolate the impacted endpoints.
Suggested answer: D

Explanation:

Isolating the impacted endpoints is the best course of action for the information security manager after an employee clicked on a link in a phishing email, triggering a ransomware attack because it prevents the ransomware from spreading to other systems or devices on the network, and minimizes the damage or disruption caused by the attack. Wiping the affected system is not a good course of action because it may destroy any evidence or data that could be used for investigation or recovery. Notifying internal legal counsel is not a good course of action because it does not address the immediate threat or impact of the ransomware attack. Notifying senior management is not a good course of action because it does not address the immediate threat or impact of the ransomware attack.

Reference: https://www.isaca.org/resources/isaca-journal/issues/2017/volume-5/incident-response-lessons-learned https://www.isaca.org/resources/isaca-journal/issues/2018/volume-3/incident-response-lessons-learned

asked 01/10/2024
ERIC MERRILL
41 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first