Study. uk . com
  1. Home
  2. All questions
  3. Question 795

CISM study material · question 795 of 1000

Which consequence does NIST attach to skipping or performing magnitude estimation superficially?

  1. Invalidating the chain of custody for all of the evidence that had already been collected from each one of the systems it affected
  2. Delaying the notification of all of the parties affected by the incident beyond the deadline that the applicable regulator has set
  3. Overestimating the incident and so wasting the response resources that were still available for the rest of the affected estate that it had also touched
  4. Underestimating the incident, allowing it to continue indefinitely on other targets without the organisation's knowledge
Show the answer

Answer: D. Underestimating the incident, allowing it to continue indefinitely on other targets without the organisation's knowledge

SP 800-61r3 warns a skipped or shallow estimate leaves the incident undersized, so it can run on against other targets indefinitely with nobody watching.

Source: NIST SP 800-61 Rev. 3 (NIST) — Table 3 RS.AN-08.N1

Challenge yourself on this topic → Study as cards