GIAC
GCIH · Question #547
Your incident handling team receives the following information: - The help desk is getting password reset requests from remote employees. - When contacted by the help desk technician, the employees cl
The correct answer is B. The password requests are an Incident; the out of sync backups are an Event. The password reset requests present an intent to harm, or at least the possibility of harm, which causes them to be classified as incidents. The out-of-sync backup is an event until further investigation reveals more information.
Incident Response & Cyber Kill Chain
Question
Your incident handling team receives the following information:
- The help desk is getting password reset requests from remote employees.
- When contacted by the help desk technician, the employees claim they did not make these
requests.
- A backup administrator is reporting one of the backup nodes in out-of-sync.
How should the information be classified?
Options
- ABoth should be classified as Incidents
- BThe password requests are an Incident; the out of sync backups are an Event
- CThe password requests are an Event; the out of sync backups are an Incident
- DBoth should be classified as Events
How the community answered
(46 responses)- A4% (2)
- B70% (32)
- C17% (8)
- D9% (4)
Explanation
The password reset requests present an intent to harm, or at least the possibility of harm, which causes them to be classified as incidents. The out-of-sync backup is an event until further investigation reveals more information.
Topics
#incident classification#event vs incident#incident handling#password reset attack
Community Discussion
No community discussion yet for this question.