312-50V11 · Question #366
The intrusion detection system at a software development company suddenly generates multiple alerts regarding attacks against the company's external webserver, VPN concentrator, and DNS servers. What
The correct answer is C. Investigate based on the potential effect of the incident.. When multiple IDS alerts fire simultaneously, the security team should triage by potential business impact rather than arbitrary criteria like arrival order or maintenance schedules.
Question
The intrusion detection system at a software development company suddenly generates multiple alerts regarding attacks against the company's external webserver, VPN concentrator, and DNS servers. What should the security team do to determine which alerts to check first?
Options
- AInvestigate based on the maintenance schedule of the affected systems.
- BInvestigate based on the service level agreements of the systems.
- CInvestigate based on the potential effect of the incident.
- DInvestigate based on the order that the alerts arrived in.
How the community answered
(63 responses)- A11% (7)
- B5% (3)
- C81% (51)
- D3% (2)
Why each option
When multiple IDS alerts fire simultaneously, the security team should triage by potential business impact rather than arbitrary criteria like arrival order or maintenance schedules.
Maintenance schedules reflect planned downtime windows, not the severity or urgency of an active security incident.
SLAs define uptime commitments but do not directly measure the security severity or potential damage of an ongoing attack.
Prioritizing by potential effect of the incident ensures that threats with the greatest business impact, such as a compromised DNS server causing widespread outages, are addressed before lower-impact events. This risk-based triage approach is the foundation of incident response best practices per NIST SP 800-61. It focuses limited analyst resources where the damage is likely greatest.
Alert arrival order does not correlate with attack severity; a low-severity alert may arrive before a critical one.
Concept tested: Incident response triage and prioritization by impact
Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
Topics
Community Discussion
No community discussion yet for this question.