During incident containment, which action is correct?

Question

BlackTom AI · Accepted Answer

When evaluating actions during incident containment, we need to consider actions that limit spread and preserve evidence rather than destroy information.
Option a: Erase logs. This is typically inappropriate during containment because it destroys forensic evidence and hampers incident investigation, making it harder to trace the breach and learn from it. Logs are essential for understanding scope and impact.
Option b: Notify press. Public communications are often coordinated through an incident response or communications plan. Premature or unapproved disclosure can cause confusion, panic, and reveal sensitive details; containment focuses on technical steps first.
Option c: Shutdown network. While isolating affected segments is important, a blanket network shutdown is drastic and can disrupt critical services and operations. Containment aims to minimize impact while containing the incident, not necessarily taking the entire network offline.
Option d: Isolate infected hosts. This targets the source of the outbreak by removing compromised machines from the broader network, preventing lateral movement and further spread while investigators assess and remediate the incident. This aligns with standard containment practices.
Thus, the action that best supports containment objectives is to isolate infected hosts, ensuring containment without unnecessary disruption or data loss.

Ethical Hacking and Incident Response (082025-ZED)

During incident containment, which action is correct?

查看解析

登录即可查看完整答案

类似问题

Question at position 19 When the attack is minor and unlikely to escalateWhen the root cause of the incident has been identified and requires extensive remediationWhen an organization has unlimited resourcesWhen there is a lack of skilled personnel to manage the incident

Question at position 17 NIST Special Publication 800-61r1 NIST Special Publication 800-61r2 NIST Special Publication (SP) 800-53NIST Special Publication 800-86

Question at position 8 By identifying the types of incidents that might occurBy establishing the budget for cybersecurity measuresBy mapping out potential escape routes for personnelBy pre-defining containment strategies for different types of incidents

Question at position 4 Creating well-defined procedures and checklistsFocusing solely on detection mechanismsPurchasing additional security softwareHiring more staff

Question at position 23 System configuration filesEmails from the target’s inboxFinancial data of the organizationUser account informationClear my selection

更多留学生实用工具

考试浏览器助手

风格化写作助手

论文查重助手

文献引用助手

课堂转译助手

课堂笔记助手

Quiz搜索助手

学校历年真题

智能刷题助手

智能匹配练习

希望你的学习变得更简单