Study. uk . com
  1. Home
  2. All questions
  3. Question 789

CISM study material · question 789 of 1000

Which three means of recording facts and actions during an investigation does NIST name?

  1. Interviews with all of the staff who were involved, written questionnaires and signed witness statements
  2. Screenshots, memory dumps and disk images
  3. A paper logbook, audio or video recordings, and automatic session monitoring and logging
  4. Email, instant messaging and all of the shared documents that the response team itself already keeps
Show the answer

Answer: C. A paper logbook, audio or video recordings, and automatic session monitoring and logging

SP 800-61r3 accepts several ways of capturing what was found and done, among them a paper logbook, audio or video recording, and automatic session monitoring and logging, so far as plan and policy allow.

Source: NIST SP 800-61 Rev. 3 (NIST) — Table 3 RS.AN-06.N1

Challenge yourself on this topic → Study as cards