GCIH · Question #768
While examining multiple compromised systems, an investigator lists a priority for each machine based on executive input and the type of service and data each machine provides the organization. Which
The correct answer is D. Triaging. Triaging is the process of prioritizing compromised or affected systems based on their business value, data sensitivity, and operational importance to focus investigative resources effectively.
Question
While examining multiple compromised systems, an investigator lists a priority for each machine based on executive input and the type of service and data each machine provides the organization. Which investigative technique does this describe?
Options
- APivoting
- BEnumeration
- CAttribution
- DTriaging
How the community answered
(62 responses)- A2% (1)
- B3% (2)
- C5% (3)
- D90% (56)
Why each option
Triaging is the process of prioritizing compromised or affected systems based on their business value, data sensitivity, and operational importance to focus investigative resources effectively.
Pivoting refers to an attacker (or tester) using one compromised system as a launchpad to access other systems in the network.
Enumeration is the active reconnaissance technique of gathering information about systems, users, services, and network resources.
Attribution is the process of identifying the threat actor or group responsible for an attack, not prioritizing systems for investigation.
Triaging in incident response involves ranking systems by priority using criteria such as executive guidance, service criticality, and the sensitivity of data handled - exactly what the scenario describes. This ensures that investigators allocate limited resources to the systems whose compromise poses the greatest organizational risk first, following frameworks like NIST SP 800-61.
Concept tested: Incident response triage and system prioritization
Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
Topics
Community Discussion
No community discussion yet for this question.