Study. uk . com
  1. Home
  2. All questions
  3. Question 796

CISM study material · question 796 of 1000

What does the Detect function encompass in the incident response Community Profile?

  1. The triage and validation of reported incidents
  2. The declaration of an incident by the designated authority once all of the collected evidence has been reviewed and weighed up
  3. All the monitoring and analysis performed to find and characterise potentially adverse events and so find incidents
  4. The technical tooling used to generate alerts
Show the answer

Answer: C. All the monitoring and analysis performed to find and characterise potentially adverse events and so find incidents

SP 800-61r3 puts everything done to watch and analyse — the work of spotting and characterising potentially adverse events, and through them incidents — inside Detect.

Source: NIST SP 800-61 Rev. 3 (NIST) — Table 3 DE.N1

Challenge yourself on this topic → Study as cards