Refer to the exhibit. Which statement is correct regarding the event displayed?

The correct answer is B. The security event risk is considered open. Unhandled: The security event risk is not mitigated or contained, so it is considered open. For example, an IPS/AV log with action=pass will have the event status Unhandled. Botnet and IoC events are also considered Unhandled.

Event Management

Question

Exhibit

Options

AThe security risk was blocked or dropped.
BThe security event risk is considered open.
CAn incident was created from this event.
DThe risk source is isolated.

How the community answered

(35 responses)

A
3% (1)
B
71% (25)
C
6% (2)
D
20% (7)

Explanation

Unhandled: The security event risk is not mitigated or contained, so it is considered open. For example, an IPS/AV log with action=pass will have the event status Unhandled. Botnet and IoC events are also considered Unhandled.

Topics

#event status#security event#incident creation#event display

Community Discussion

No community discussion yet for this question.

Full NSE5_FAZ-7.2 Practice