Study. uk . com
  1. Home
  2. All questions
  3. Question 812

CISM study material · question 812 of 1000

Which danger does NIST attach to deliberately delaying containment in order to observe an attacker?

  1. The organisation loses the ability to eradicate the attacker later on in the course of the same response
  2. The delay invalidates the severity rating that was given to the incident at the point when it was declared
  3. The attacker could escalate unauthorised access or compromise other systems during the delay
  4. The evidence gathered becomes inadmissible
Show the answer

Answer: C. The attacker could escalate unauthorised access or compromise other systems during the delay

SP 800-61r3 warns the intentional delay can be dangerous because an attacker could escalate unauthorised access or compromise other systems while the organisation is observing.

Source: NIST SP 800-61 Rev. 3 (NIST) — Table 3 RS.MI.R1

Challenge yourself on this topic → Study as cards