QUESTION: 17

The CSIRT team is following the existing recovery plans on non-production systems in a PRE-BREACH scenario. This action is being executed in which function?

Protect
Recover
Identify
Respond

Answer(s): A

Reveal Solution Next Question

QUESTION: 18

What is a consideration when performing data collection in Information Security Continuous Monitoring?

Data collection efficiency is increased through automation.
The more data collected, the better chances to catch an anomaly.
Collection is used only for compliance requirements.
Data is best captured as it traverses the network.

Answer(s): A

Reveal Solution Next Question

An organization has a policy to respond “ASAP” to security incidents. The security team is having a difficult time prioritizing events because they are responding to all of them, in order of receipt. Which part of the IRP does the team need to implement or update?

Scheduling of incident responses
‘Post mortem’ documentation
Classification of incidents
Containment of incidents

Answer(s): C

Reveal Solution Next Question

QUESTION: 20

Your firewall blocked several machines on your network from connecting to a malicious IP address. After reviewing the logs, the CSIRT discovers all Microsoft Windows machines on the network have been affected based on a newly published CVE.

Based on the IRP, what should be done immediately?

Update the asset inventory
Contain the breach
Eradicate the breach
Revise the IRP

Answer(s): A

Reveal Solution Next Question

Free DES-9131 Exam Braindumps (page: 6)

QUESTION: 17

QUESTION: 18

QUESTION: 19

QUESTION: 20

DES-9131 Discussions & Posts