Study. uk . com
  1. Home
  2. All questions
  3. Question 788

CISM study material · question 788 of 1000

A response team identifies the immediate trigger of an incident and closes the analysis. Which NIST recommendation is unmet?

  1. Recording the indicators of compromise observed
  2. Analysing the incident to find the underlying or systemic root causes
  3. Estimating the incident's magnitude
  4. Preserving the integrity of the investigation records
Show the answer

Answer: B. Analysing the incident to find the underlying or systemic root causes

SP 800-61r3 recommends analysing the incident to find the underlying or systemic root causes, beyond determining the sequence of events and the vulnerabilities, threats and actors directly or indirectly involved.

Source: NIST SP 800-61 Rev. 3 (NIST) — Table 3 RS.AN-03.R3

Challenge yourself on this topic → Study as cards