Study. uk . com
  1. Home
  2. All questions
  3. Question 766

CISM study material · question 766 of 1000

A monitoring tool flags an anomaly and an analyst opens an incident record immediately. Which caution does NIST give?

  1. Anomalies may have benign or malicious foundations, so an anomaly alone is not an incident
  2. Anomalies may be recorded only after management approval
  3. Anomalies should be discarded unless corroborated by threat intelligence
  4. Anomalies must always be treated as incidents until proven otherwise
Show the answer

Answer: A. Anomalies may have benign or malicious foundations, so an anomaly alone is not an incident

SP 800-61r3 notes the fidelity of events varies and that anomalies may have benign or malicious foundations, with some incidents easy to find amid the noise and others requiring deep specialised knowledge.

Source: NIST SP 800-61 Rev. 3 (NIST) — Table 3 DE.AE.N2

Challenge yourself on this topic → Study as cards