Study. uk . com
  1. Home
  2. All questions
  3. Question 772

CISM study material · question 772 of 1000

Which two inputs does NIST say the decision to declare an incident should weigh? Choose two.

  1. Known false positives
  2. The incident criteria applied to the known and assumed characteristics of the analysed activity
  3. The availability of the incident response team at that time
  4. The likely cost of the response effort
Show the answer

Answer: B. The incident criteria applied to the known and assumed characteristics of the analysed activity
A. Known false positives

SP 800-61r3 recommends applying incident criteria to known and assumed characteristics of analysed activity, and considering known false positives, to determine whether an incident should be declared.

Source: NIST SP 800-61 Rev. 3 (NIST) — Table 3 DE.AE-08.R1

Challenge yourself on this topic → Study as cards