QuestionQ45

Threat Intelligence in Incident Response

The following are the steps involved in forensic readiness planning:

  1. Keep an incident response team prepared to review the incident and preserve the evidence.
  2. Create a procedure-documentation process.
  3. Identify the potential evidence needed for an incident.
  4. Determine the evidence sources.
  5. Establish a legal advisory board to guide the investigation process.
  6. Determine whether the incident requires a full or formal investigation.
  7. Establish a policy for securely handling and storing collected evidence.
  8. Define a policy that establishes the path for legally extracting electronic evidence with minimal disruption.

Identify the correct sequence of steps involved in forensic readiness planning.

  • A 1−>2−>3−>4−>5−>6−>7−>8
  • B 2−>3−>1−>4−>6−>5−>7−>8
  • C 3−>1−>4−>5−>8−>2−>6−>7
  • D 3−>4−>8−>7−>6−>2−>5−>1
Explanation

EC-Council's CHFI curriculum defines forensic readiness planning as: (1) identify the potential evidence needed for the incident, (2) determine the sources of that evidence, (3) define a policy for legally extracting electronic evidence with minimal disruption to the business, (4) establish a policy for securely handling and storing the collected evidence, (5) determine whether the incident requires a full or formal investigation, (6) create a procedure-documentation process, (7) establish a legal advisory board to guide the investigation, and (8) keep an incident response team prepared to review the incident and preserve evidence — corresponding to the sequence 3→4→8→7→6→2→5→1.

Community Discussion

No comments yet. Be the first to start the discussion!