Study. uk . com
  1. Home
  2. All questions
  3. Question 798

CISM study material · question 798 of 1000

What does NIST recommend detection technologies do with the incidents they have confirmed?

  1. Queue them for review at the next analyst shift change so that a person confirms each one
  2. Hold them until corroborated by a second source
  3. Escalate them directly to senior management
  4. Report them automatically, rather than waiting for a human to transcribe them
Show the answer

Answer: D. Report them automatically, rather than waiting for a human to transcribe them

SP 800-61r3 recommends that detection technologies should automatically report incidents that they have confirmed, as part of executing the incident response plan once an incident is declared.

Source: NIST SP 800-61 Rev. 3 (NIST) — Table 3 RS.MA-01.R1

Challenge yourself on this topic → Study as cards