Study. uk . com
  1. Home
  2. All questions
  3. Question 820

CISM study material · question 820 of 1000

Which two operations does NIST include in incident recovery? Choose two.

  1. Determining the attacker's identity
  2. Notifying the organisation's own insurers of the loss that has been suffered
  3. Changing passwords and tightening security controls
  4. Replacing compromised files with clean versions
Show the answer

Answer: D. Replacing compromised files with clean versions
C. Changing passwords and tightening security controls

SP 800-61r3's recovery work covers restoration from clean backups, rebuilds, swapping tainted files for clean copies, patching, credential changes and tightening the controls.

Source: NIST SP 800-61 Rev. 3 (NIST) — Table 3 RC.N2

Challenge yourself on this topic → Study as cards