nerdexam
GIAC

GCIH · Question #768

While examining multiple compromised systems, an investigator lists a priority for each machine based on executive input and the type of service and data each machine provides the organization. Which

The correct answer is D. Triaging. Triaging is the process of prioritizing compromised or affected systems based on their business value, data sensitivity, and operational importance to focus investigative resources effectively.

Incident Response & Cyber Kill Chain

Question

While examining multiple compromised systems, an investigator lists a priority for each machine based on executive input and the type of service and data each machine provides the organization. Which investigative technique does this describe?

Options

  • APivoting
  • BEnumeration
  • CAttribution
  • DTriaging

How the community answered

(62 responses)
  • A
    2% (1)
  • B
    3% (2)
  • C
    5% (3)
  • D
    90% (56)

Why each option

Triaging is the process of prioritizing compromised or affected systems based on their business value, data sensitivity, and operational importance to focus investigative resources effectively.

APivoting

Pivoting refers to an attacker (or tester) using one compromised system as a launchpad to access other systems in the network.

BEnumeration

Enumeration is the active reconnaissance technique of gathering information about systems, users, services, and network resources.

CAttribution

Attribution is the process of identifying the threat actor or group responsible for an attack, not prioritizing systems for investigation.

DTriagingCorrect

Triaging in incident response involves ranking systems by priority using criteria such as executive guidance, service criticality, and the sensitivity of data handled - exactly what the scenario describes. This ensures that investigators allocate limited resources to the systems whose compromise poses the greatest organizational risk first, following frameworks like NIST SP 800-61.

Concept tested: Incident response triage and system prioritization

Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf

Topics

#triaging#incident prioritization#investigative technique#compromised systems

Community Discussion

No community discussion yet for this question.

Full GCIH Practice