GIAC
GCIH · Question #507
GCIH Question #507: Real Exam Question with Answer & Explanation
Sign in or unlock GCIH to reveal the answer and full explanation for question #507. The question stem and answer options stay visible for context.
Question
Which activity would be conducted as part of the containment phase?
Options
- ACompare recent backups with a current backup to remove malware an attacker could use to
- BVerify the most recent system back up in case the system needs to be rebuilt later.
- CMove compromised systems to their own network segment based on approval from system
- DRun tools used to gather information about an external attacker from an uncompromised system
Unlock GCIH to see the answer
You've previewed enough free GCIH questions. Unlock GCIH for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.