Which of the following cannot be undertaken in conjunction or while computer incident handling is ongoing?

Question

Options

• ASystem development activity
• BHelp-desk function
• CSystem Imaging
• DRisk management process

• A
  92% (23)
• C
  4% (1)
• D
  4% (1)

Explanation

During active incident handling, any system development activity on the affected systems must be halted. Developing or modifying system code while an incident is being investigated can contaminate evidence, alter system state, introduce new vulnerabilities, or interfere with containment and eradication efforts. Help-desk functions (B) can continue to support other users. System imaging (C) is actually part of the incident response process itself. Risk management (D) is an ongoing organizational process that runs in parallel. System development is the only activity that directly conflicts with the integrity of the incident response.

No community discussion yet for this question.