ExamGecko
Question list
Search
Search

Question 357 - CISM discussion

Report
Export

After a server has been attacked, which of the following is the BEST course of action?

A.
Initiate incident response.
Answers
A.
Initiate incident response.
B.
Review vulnerability assessment.
Answers
B.
Review vulnerability assessment.
C.
Conduct a security audit.
Answers
C.
Conduct a security audit.
D.
Isolate the system.
Answers
D.
Isolate the system.
Suggested answer: A

Explanation:

Initiating incident response is the best course of action after a server has been attacked because it activates the incident response plan or process, which defines the roles and responsibilities, procedures and protocols, tools and techniques for responding to and managing a security incident effectively and efficiently. Reviewing vulnerability assessment is not a good course of action because it does not address the current attack or its impact, but rather evaluates the potential weaknesses or exposures of the server. Conducting a security audit is not a good course of action because it does not address the current attack or its impact, but rather verifies and validates the compliance or performance of the server's security controls or systems. Isolating the system is not a good course of action because it does not address the current attack or its impact, but rather stops or limits any communication or interaction with the server.

Reference: https://www.isaca.org/resources/isaca-journal/issues/2017/volume-5/incident-response-lessons-learned https://www.isaca.org/resources/isaca-journal/issues/2018/volume-3/incident-response-lessons-learned

asked 01/10/2024
Swen Leuning
49 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first