A helpdesk ticket has been escalated to the incident response team. According to the FIRST organization classification guidelines, during which incident response phase should the team document the…

The correct answer is D. Containment. It is important to document various characteristics of the incident early on in the Containment phase. The FIRST organization distributes an incident Case Classification document that recommends characterizing an incident based on three areas: it's general category, the…

Incident Response & Cyber Kill Chain

Question

A helpdesk ticket has been escalated to the incident response team. According to the FIRST organization classification guidelines, during which incident response phase should the team document the following information? Category: Compromised Intellectual Property Criticality: High Sensitivity: Restricted to response team and management

Options

APreparation
BEradication
CLessons Learned
DContainment

How the community answered

(47 responses)

A
13% (6)
B
6% (3)
C
2% (1)
D
79% (37)

Explanation

It is important to document various characteristics of the incident early on in the Containment phase. The FIRST organization distributes an incident Case Classification document that recommends characterizing an incident based on three areas: it's general category, the criticality of impacted systems and data, and the sensitivity with which information about the case itself should be treated.

Topics

#incident classification#FIRST guidelines#containment phase#IR documentation

Community Discussion

No community discussion yet for this question.

Full GCIH Practice