ExamGecko
Question list
Search
Search

List of questions

Search

Related questions











Question 394 - SY0-601 discussion

Report
Export

A security analyst is currently addressing an active cyber incident. The analyst has been able to identify affected devices that are running a malicious application with a unique hash. Which of the following is the next step according to the incident response process?

A.
Recovery
Answers
A.
Recovery
B.
Lessons learned
Answers
B.
Lessons learned
C.
Containment
Answers
C.
Containment
D.
Preparation
Answers
D.
Preparation
Suggested answer: C

Explanation:

Containment is the next step according to the incident response process after identifying affected devices that are running a malicious application with a unique hash. Containment involves isolating the compromised devices or systems from the rest of the network to prevent the spread of the attack and limit its impact. Containment can be done by disconnecting the devices from the network, blocking network traffic to or from them, or applying firewall rules or access control lists. Containment is a critical step in incident response because it helps to preserve evidence for

further analysis and remediation, and reduces the risk of data loss or exfiltration

https://www.fortinet.com/resources/cyberglossary/incident-response

https://www.ibm.com/topics/incident-response

asked 02/10/2024
Hossein Nasri
31 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first