What is the first step that a containment team should take?

The correct answer is D. Document and secure the incident scene. In moving to the containment phase, we have already declared an incident. It is important to document various characteristics of the incident early on in our containment phase. If you are dealing with a suspected crime, still or digital cameras can be used to record the scene…

Incident Response & Cyber Kill Chain

Question

Options

ADetermine if the events indicate an incident
BRemove network and Internet access for affected systems
CReview firewall rules for preventing attacker access
DDocument and secure the incident scene

How the community answered

(54 responses)

A
2% (1)
B
4% (2)
D
94% (51)

Explanation

In moving to the containment phase, we have already declared an incident. It is important to document various characteristics of the incident early on in our containment phase. If you are dealing with a suspected crime, still or digital cameras can be used to record the scene. This documentation and securing of the incident area occurs prior to configuring technical controls to further contain the incident.

Topics

#incident containment#first response#scene documentation#incident handling

Community Discussion

No community discussion yet for this question.

Full GCIH Practice