CISM: Certified Information Security ManagerDemo

Question

After a successful attack, at the completion of which incident-response phase should an information security manager be confident that the malware has stopped spreading?

A Recovery
B Eradication
C Identification
D Containment

Explanation

The containment phase isolates affected systems and limits the incident’s scope so malware cannot continue propagating to additional assets.

CISM: Certified Information Security ManagerDemo

AstroTutor

Notes

Readiness

QuestionQ945

Community Discussion