Study. uk . com
  1. Home
  2. All questions
  3. Question 786

CISM study material · question 786 of 1000

What does the Incident Analysis category focus on, in CSF terms?

  1. Containing the incident and then eradicating the attacker's presence from every one of the systems that have been affected
  2. Investigating, determining and documenting what has happened during an incident, and how and why it happened
  3. Notifying affected parties and regulators
  4. Restoring systems and confirming normal operation
Show the answer

Answer: B. Investigating, determining and documenting what has happened during an incident, and how and why it happened

SP 800-61r3 puts Incident Analysis on establishing and writing down the course of an incident — what took place, together with the how and the why.

Source: NIST SP 800-61 Rev. 3 (NIST) — Table 3 RS.AN.N1

Challenge yourself on this topic → Study as cards