Study. uk . com
  1. Home
  2. All questions
  3. Question 794

CISM study material · question 794 of 1000

Where does NIST say responders should search when estimating an incident's magnitude?

  1. Only on internet-facing systems
  2. Only on systems sharing the same network segment
  3. Only on the assets confirmed to be compromised
  4. On the assets known to be targeted and on other potential targets as well
Show the answer

Answer: D. On the assets known to be targeted and on other potential targets as well

SP 800-61r3 widens the search beyond the assets already known to be hit, asking responders to hunt for compromise indicators, persistence and other traces on other likely targets too.

Source: NIST SP 800-61 Rev. 3 (NIST) — Table 3 RS.AN-08.R1

Challenge yourself on this topic → Study as cards