CERTIFIED-IN-CYBERSECURITY · Question #131
In an incident response process, which phase uses indicators of compromise and log analysis as part of a review of events?
The correct answer is B. Identification. The standard incident response lifecycle (e.g., NIST SP 800-61) includes Preparation, Identification (Detection & Analysis), Containment, Eradication, Recovery, and Lessons Learned. The Identification phase is where analysts review logs, alerts, and Indicators of Compromise…
Question
In an incident response process, which phase uses indicators of compromise and log analysis as part of a review of events?
Options
- AContainment
- BIdentification
- CPreparation
- DThe identification phase of an incident response process involves recognizing the signs of a
How the community answered
(54 responses)- A2% (1)
- B91% (49)
- C6% (3)
- D2% (1)
Explanation
The standard incident response lifecycle (e.g., NIST SP 800-61) includes Preparation, Identification (Detection & Analysis), Containment, Eradication, Recovery, and Lessons Learned. The Identification phase is where analysts review logs, alerts, and Indicators of Compromise (IoCs) to determine whether an incident has actually occurred and to understand its scope and nature. Containment (A) focuses on limiting the spread after confirmation. Preparation (C) involves establishing tools, policies, and training before an incident occurs.
Topics
Community Discussion
No community discussion yet for this question.