GCED: GIAC Certified Enterprise DefenderDemo

Question

Which of the following is an outcome of the initial incident-response triage?

A Removal of unnecessary accounts from compromised systems
B Segmentation of the network to protect critical assets
C Resetting registry keys that vary from the baseline configuration
D Determining whether encryption is in use on in scope systems

Explanation

Initial incident triage rapidly analyzes and validates the incident to determine its scope and collect the information needed to prioritize subsequent response activities. Establishing whether in-scope systems use encryption is part of that assessment; account removal, network segmentation, and registry restoration are response or remediation actions taken later.

Learn more

NIST SP 800-61 Rev. 2: Computer Security Incident Handling Guide

GCED: GIAC Certified Enterprise DefenderDemo

AstroTutor

Notes

Readiness

QuestionQ14

Community Discussion