ExamGecko
Question list
Search
Search

Question 413 - CISM discussion

Report
Export

An incident response team has established that an application has been breached. Which of the following should be done NEXT?

A.
Maintain the affected systems in a forensically acceptable state
Answers
A.
Maintain the affected systems in a forensically acceptable state
B.
Conduct a risk assessment on the affected application
Answers
B.
Conduct a risk assessment on the affected application
C.
Inform senior management of the breach.
Answers
C.
Inform senior management of the breach.
D.
Isolate the impacted systems from the rest of the network
Answers
D.
Isolate the impacted systems from the rest of the network
Suggested answer: D

Explanation:

The next thing an incident response team should do after establishing that an application has been breached is to isolate the impacted systems from the rest of the network, which means disconnecting them from the internet or other network connections to prevent further spread of the attack or data exfiltration. Isolating the impacted systems can help to contain the breach and limit its impact on the organization. The other options, such as maintaining the affected systems in a forensically acceptable state, conducting a risk assessment, or informing senior management, may be done later in the incident response process, after isolating the impacted systems.

Reference:

https://www.crowdstrike.com/cybersecurity-101/incident-response/

https://learn.microsoft.com/en-us/security/operations/incident-response-playbooks

https://www.invicti.com/blog/web-security/incident-response-steps-web-application-security/

asked 01/10/2024
TIAM HERVE
47 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first