Study. uk . com
  1. Home
  2. All questions
  3. Question 817

CISM study material · question 817 of 1000

Which three eradication actions does NIST give as examples of eliminating persistence mechanisms and entry points?

  1. Notifying the users affected, updating the response plan and then briefing the senior management on what has actually happened
  2. Restoring each of the affected hosts from backup, patching all of them and then changing every one of the passwords involved
  3. Removing malware, shutting down breached accounts, and finding and fixing every vulnerability that was exploited
  4. Isolating the affected host, capturing the whole of its memory and then taking a full forensic image of every single one of its own disks too
Show the answer

Answer: C. Removing malware, shutting down breached accounts, and finding and fixing every vulnerability that was exploited

SP 800-61r3 has eradication follow containment by stripping out persistence and closing entry points — malware removed, breached accounts disabled, exploited weaknesses found and remedied.

Source: NIST SP 800-61 Rev. 3 (NIST) — Table 3 RS.MI-02.N1

Challenge yourself on this topic → Study as cards