Study. uk . com
  1. Home
  2. All questions
  3. Question 700

CISM study material · question 700 of 1000

Which set correctly names the phases of the older SP 800-61 incident response life cycle?

  1. Prepare the environment; categorise the event; contain the damage; restore the affected service to its normal working order
  2. Triage the incoming report; investigate the root cause; remediate the weakness; report the outcome to management
  3. Identify the affected assets; protect each of them; detect the events; respond to whatever has been detected
  4. Preparation; detection and analysis; containment, eradication and recovery; post-incident activity
Show the answer

Answer: D. Preparation; detection and analysis; containment, eradication and recovery; post-incident activity

The previous SP 800-61 model had four phases: preparation, detection and analysis, containment eradication and recovery, and post-incident activity.

Source: NIST SP 800-61 Rev. 3 (NIST) — Sec. 2.1 Incident Response Life Cycle Model

Challenge yourself on this topic → Study as cards