Study. uk . com
  1. Home
  2. All questions
  3. Question 787

CISM study material · question 787 of 1000

With what does NIST say root cause analysis of an incident begins?

  1. Identifying the particular threat actor that was held to be responsible for what had happened
  2. Working out the order of events and which assets and resources figured in each one
  3. Notifying the senior leadership of the outcome of the whole of the investigation afterwards in writing
  4. Restoring the affected systems from the most recent backup that was taken of each one of them
Show the answer

Answer: B. Working out the order of events and which assets and resources figured in each one

SP 800-61r3 starts root cause work by laying out the sequence of what happened and attaching the assets and resources involved at each step.

Source: NIST SP 800-61 Rev. 3 (NIST) — Table 3 RS.AN-03.R1

Challenge yourself on this topic → Study as cards