Study. uk . com
  1. Home
  2. All questions
  3. Question 827

CISM study material · question 827 of 1000

After systems are restored and users are back online, which further NIST recommendation applies?

  1. Archiving all evidence collected during the response
  2. Removing the temporary controls applied during containment
  3. Closing the incident record within a fixed period
  4. Watching how restored systems perform, to confirm the restoration was good enough
Show the answer

Answer: D. Watching how restored systems perform, to confirm the restoration was good enough

SP 800-61r3 keeps an eye on restored systems afterwards to see whether the restoration held, alongside checking services came back in the right order and confirming normal running with the owners.

Source: NIST SP 800-61 Rev. 3 (NIST) — Table 3 RC.RP-04.R3

Challenge yourself on this topic → Study as cards