According to NIST what option is unnecessary for containment strategy?

The correct answer is A. The delayed containment B. Monitoring with methods other than sandboxing. NIST SP 800-61 Rev 2 outlines containment strategy criteria but does not require delayed containment or non-sandboxing monitoring methods as part of an effective containment approach.

Security Policies and Procedures

Question

Options

AThe delayed containment
BMonitoring with methods other than sandboxing

How the community answered

(39 responses)

A
100% (39)

Why each option

NIST SP 800-61 Rev 2 outlines containment strategy criteria but does not require delayed containment or non-sandboxing monitoring methods as part of an effective containment approach.

AThe delayed containmentCorrect

Delayed containment is unnecessary because NIST SP 800-61 Rev 2 emphasizes timely containment to limit damage and prevent incident spread; deliberately delaying containment without documented justification contradicts the core objective of bounding incident scope.

BMonitoring with methods other than sandboxingCorrect

Monitoring with methods other than sandboxing is unnecessary for containment because NIST recommends sandboxing as the safe, isolated monitoring technique; using alternative live-environment monitoring methods during containment can expose production systems to continued compromise.

Concept tested: NIST SP 800-61 Rev 2 containment strategy components

Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf

Topics

#NIST SP 800-61#containment strategy#incident response#sandboxing

Community Discussion

No community discussion yet for this question.

Full 210-255 Practice