Study. uk . com
  1. Home
  2. All questions
  3. Question 821

CISM study material · question 821 of 1000

An intrusion involves a highly sophisticated actor whose full set of techniques is not known. How far does NIST accept recovery may have to go?

  1. As far as rotating every credential in the organisation
  2. As far as isolating the affected network segment permanently
  3. As far as rebuilding the affected operating systems from clean media
  4. As far as replacing the hardware of all the compromised systems
Show the answer

Answer: D. As far as replacing the hardware of all the compromised systems

SP 800-61r3 allows for the extreme case: against a very sophisticated actor whose full tactics remain hidden, the hardware of every compromised system may have to be swapped out.

Source: NIST SP 800-61 Rev. 3 (NIST) — Table 3 RC.N2

Challenge yourself on this topic → Study as cards