QUESTION: 137

Which NIST IR category stakeholder is responsible for coordinating incident response among various business units, minimizing damage, and reporting to regulatory agencies?

CSIRT
PSIRT
public affairs
management

Answer(s): D

Reveal Solution Next Question

QUESTION: 138

Which incidence response step includes identifying all hosts affected by an attack?

detection and analysis
post-incident activity
preparation
containment, eradication, and recovery

Answer(s): D

Explanation:

3.3.3 Identifying the Attacking Hosts During incident handling, system owners and others sometimes want to or need to identify the attacking host or hosts. Although this information can be important, incident handlers should generally stay focused on containment, eradication, and recovery. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf The response phase, or containment, of incident response, is the point at which the incident response team begins interacting with affected systems and attempts to keep further damage from occurring as a result of the incident.

Reveal Solution Next Question

QUESTION: 139

Which two elements are used for profiling a network? (Choose two.)

session duration
total throughput
running processes
listening ports
OS fingerprint

Answer(s): A,B

Explanation:

A network profile should include some important elements, such as the following:

Total throughput the amount of data passing from a given source to a given destination in a given period of time.
Session duration the time between the establishment of a data flow and its termination Ports used a list of TCP or UDP processes that are available to accept data Critical asset address space the IP addresses or the logical location of essential systems or data Profiling data are data that system has gathered, these data helps for incident response and to detect incident Network profiling = throughput, sessions duration, port used, Critical Asset Address Space Host profiling = Listening ports, logged in accounts, running processes, running tasks,applications

Reveal Solution Next Question