Which phase of the incident response lifecycle includes creating and validating alerts?

The correct answer is C. Detection & Analysis. Security Guidance v4.0 > p.102 > 9.1.1 Incident Response Lifecycle: - Alerts [endpoint protection, network security monitoring creation, privilege escalation, other indicators of compromise (baseline and anomaly detection), and user behavior analytics - Validate alerts…

Cloud Incident Response

Question

Options

APreparation
BContainment, Eradication, Recovery
CDetection & Analysis
DAuditing & Logging
EPost-mortem

How the community answered

(39 responses)

A
3% (1)
B
3% (1)
C
79% (31)
D
5% (2)
E
10% (4)

Explanation

Security Guidance v4.0 > p.102 > 9.1.1 Incident Response Lifecycle: - Alerts [endpoint protection, network security monitoring creation, privilege escalation, other indicators of compromise (baseline and anomaly detection), and user behavior analytics - Validate alerts (reducing false positives) and escalation.

Topics

#incident response#detection and analysis#alert validation#IR lifecycle

Community Discussion

No community discussion yet for this question.

Full CCSK Practice