题目
题目
多项选择题

Question at position 3 What might additional tools be needed to detect this particular incident?What indicators of the incident might the organisation detect?Which personnel would be involved in the containment, eradication, and/or recovery processes?What precursors of the incident, if any, might the organisation detect? Would any precursors cause the organisation to take action before the incident occurred?Is a policy established to classify it as a malicious activity? If so, then what part of the policy is violated?Which indicators would cause someone to think that an incident might have occurred?

选项
A.What might additional tools be needed to detect this particular incident?
B.What indicators of the incident might the organisation detect?
C.Which personnel would be involved in the containment, eradication, and/or recovery processes?
D.What precursors of the incident, if any, might the organisation detect? Would any precursors cause the organisation to take action before the incident occurred?
E.Is a policy established to classify it as a malicious activity? If so, then what part of the policy is violated?
F.Which indicators would cause someone to think that an incident might have occurred?
题目图片
查看解析

查看解析

标准答案
Please login to view
思路分析
To tackle this multi-answer question, I will evaluate each option in turn and explain why it is or isn’t appropriate for the given scenario. Option 1: What might additional tools be needed to detect this particular incident? This question focuses on the detection phase and asks about tooling requirements specific to the incident. It makes sense because detecting sophisticated or unique incidents often requires tools beyond the baseline suite, such as specialized sensors, anomaly detectors, or integrated logging capabilities tailored to the incident type. This is a valid consideration for enhancing visibility and early warning. Option 2: What indicators of the incident might the orga......Login to view full explanation

登录即可查看完整答案

我们收录了全球超50000道考试原题与详细解析,现在登录,立即获得答案。

类似问题

During incident containment, which action is correct?

Question at position 19 When the attack is minor and unlikely to escalateWhen the root cause of the incident has been identified and requires extensive remediationWhen an organization has unlimited resourcesWhen there is a lack of skilled personnel to manage the incident

Question at position 17 NIST Special Publication 800-61r1 NIST Special Publication 800-61r2 NIST Special Publication (SP) 800-53NIST Special Publication 800-86

Question at position 13 What protocols/software/policies/hardware is in place to prevent this incident from reoccurring?What happened, and at what time?What indicators of the incident might the organisation detect?Were any wrong actions taken that caused damage or inhibited recovery?What precursors of the incident, if any, might the organisation detect? Would any precursors cause the organisation to take action before the incident occurred?What information was needed sooner?Is a policy established to classify it as a malicious activity? If so, then what part of the policy is violated?How well did the incident response team deal with the incident? Were processes followed, and were they sufficient?

更多留学生实用工具

加入我们，立即解锁 海量真题 与 独家解析，让复习快人一步！