GCIH · Question #493
As an incident handler, you are responding to a server breach and have gathered the following information: An attacker can execute code of his/her choice on a vulnerable system that is successfully…
The correct answer is A. How many servers are potentially affected. The initial assessment is performed during the identification phase. As such, knowing the level of skill needed to exploit the vulnerability, the availability or lack thereof of a fix and how many servers could be affected are all important pieces of information to have in…
Question
As an incident handler, you are responding to a server breach and have gathered the following information:
An attacker can execute code of his/her choice on a vulnerable system that is successfully exploited. The value of the systems and data that have been impacted is medium to high. A public exploit is available. The vulnerability can be exploited remotely. Of the following choices, which needs to be determined as part of the initial assessments of the incident?
Options
- AHow many servers are potentially affected
- BWho will be included on the incident response team
- CWhether the server will be cleaned or rebuilt completely
- DThe most efficient way to shut down the affected servers
How the community answered
(62 responses)- A81% (50)
- B3% (2)
- C11% (7)
- D5% (3)
Explanation
The initial assessment is performed during the identification phase. As such, knowing the level of skill needed to exploit the vulnerability, the availability or lack thereof of a fix and how many servers could be affected are all important pieces of information to have in order to perform an initial assessment. Determining how (or whether) to shut down the servers would be done after the number of affected servers is determined, during containment. Whether the server should be cleaned or rebuilt is a decision made during the eradication phase. Determining who should be included in the incident response team is completed during the preparation phase.
Topics
Community Discussion
No community discussion yet for this question.