Study. uk . com
  1. Home
  2. All questions
  3. Question 811

CISM study material · question 811 of 1000

A team proposes redirecting an attacker into a sandbox to gather more evidence. Which consultation does NIST require first?

  1. Notification of the relevant regulator
  2. Approval from the affected system's owner
  3. Discussion of the strategy's feasibility with the legal department
  4. Sign-off by the external forensic provider engaged to examine the evidence gathered
Show the answer

Answer: C. Discussion of the strategy's feasibility with the legal department

SP 800-61r3 has legal weigh in before an attacker is redirected into a sandbox for observation, since that choice postpones containment and eradication.

Source: NIST SP 800-61 Rev. 3 (NIST) — Table 3 RS.MI.R1

Challenge yourself on this topic → Study as cards