GCIH · Question #420
Which of the following tasks would take place during the incident containment phase?
The correct answer is B. Create an IPS rule to block traffic from an ongoing denial-of-service attack. Incident containment focuses on limiting the spread and impact of an active incident, which includes deploying technical controls like IPS rules to stop ongoing malicious traffic.
Question
Which of the following tasks would take place during the incident containment phase?
Options
- AReview server operating system logs for unusual or malicious behavior
- BCreate an IPS rule to block traffic from an ongoing denial-of-service attack
- CRebuild a server with a clean copy of the operating system and apply all relevant patches
- DBegin documenting the incident and response actions
How the community answered
(35 responses)- A3% (1)
- B94% (33)
- D3% (1)
Why each option
Incident containment focuses on limiting the spread and impact of an active incident, which includes deploying technical controls like IPS rules to stop ongoing malicious traffic.
Reviewing server OS logs for unusual behavior is part of the detection and analysis phase, which occurs before containment.
Creating an IPS rule to block traffic from an active denial-of-service attack is a containment action - it directly limits the damage and scope of an in-progress incident without yet moving to eradication or recovery. NIST SP 800-61r2 defines containment as taking actions to prevent the incident from worsening, such as blocking malicious traffic at a network device.
Rebuilding a server with a clean OS and applying patches is a recovery and eradication action, occurring after containment.
Documenting the incident and response actions begins during detection and analysis, prior to the containment phase.
Concept tested: NIST incident response containment phase actions
Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
Topics
Community Discussion
No community discussion yet for this question.