Which of the following incident handling mistakes would occur as part of the eradication phase?

The correct answer is D. Failure to prevent re-infection or repeated compromise. Improving defenses in order to prevent re-infection is an important part of the eradication phase. Reporting an incident or asking for help should occur during the identification phase. The bulk of evidence handling activities takes place in the identification and containment pha

Incident Response & Cyber Kill Chain

Question

Options

AFailure to create working images
BMishandling or destroying evidence
CFailure to report an incident or ask for help
DFailure to prevent re-infection or repeated compromise

How the community answered

(51 responses)

A
6% (3)
B
2% (1)
C
4% (2)
D
88% (45)

Explanation

Improving defenses in order to prevent re-infection is an important part of the eradication phase. Reporting an incident or asking for help should occur during the identification phase. The bulk of evidence handling activities takes place in the identification and containment phases, and creating disk images occurs in the containment phase.

Topics

#eradication phase#re-infection prevention#incident handling#mistakes

Community Discussion

No community discussion yet for this question.

Full GCIH Practice