What is one of the first actions you should take in the containment phase of incident handling?

The correct answer is B. Provide management with incident details so they can decide whether or not to disconnect the. You may have strong feelings about leaving the system on the network to catch the intruder, or getting it unplugged to contain the incident, but the decision always comes down to management. Be sure to provide them with input for both sides of the argument, but they will make…

Incident Response & Cyber Kill Chain

Question

Options

AProvide the system administrator with input regarding disconnecting the system from the network,
BProvide management with incident details so they can decide whether or not to disconnect the
CDecide whether to remove the system from the network via a team vote. Be sure to include all
DLeave the system on the network in order to watch the attacker and collect evidence

How the community answered

(15 responses)

B
87% (13)
C
7% (1)
D
7% (1)

Explanation

You may have strong feelings about leaving the system on the network to catch the intruder, or getting it unplugged to contain the incident, but the decision always comes down to management. Be sure to provide them with input for both sides of the argument, but they will make the call.

Topics

#incident containment#management escalation#network isolation#incident handling phases

Community Discussion

No community discussion yet for this question.

Full GCIH Practice