Study. uk . com
  1. Home
  2. All questions
  3. Question 818

CISM study material · question 818 of 1000

Why does NIST require every affected host and service to be identified during eradication?

  1. So that the incident can be categorised correctly
  2. So that the incident's financial cost can be calculated
  3. So that no flaw or weakness is remediated on one system and left untouched on another
  4. So that each system owner can be billed for the response
Show the answer

Answer: C. So that no flaw or weakness is remediated on one system and left untouched on another

SP 800-61r3 recommends identifying all affected hosts and services within the organisation so that all flaws and weaknesses can be remediated, rather than fixing some instances and leaving others.

Source: NIST SP 800-61 Rev. 3 (NIST) — Table 3 RS.MI-02.R1

Challenge yourself on this topic → Study as cards