Study. uk . com
  1. Home
  2. All questions
  3. Question 765

CISM study material · question 765 of 1000

Which trade-off does NIST identify about the timing of incident detection?

  1. Indications become clearer as an attack progresses, but by then the damage and reach have grown
  2. Late detection is cheaper because fewer analysts are needed
  3. Early detection produces more false positives than late detection
  4. Detection timing has no bearing on incident impact
Show the answer

Answer: A. Indications become clearer as an attack progresses, but by then the damage and reach have grown

SP 800-61r3 sets clarity against cost: later in the attack life cycle the signs stand out more, yet impact and scope have grown with them — the reason it pushes for earlier detection.

Source: NIST SP 800-61 Rev. 3 (NIST) — Table 3 DE.AE.N3

Challenge yourself on this topic → Study as cards