CISSP-ISSAP: Information Systems Security Architecture Professional

Question

You work as an incident handler at Mariotrixt.Inc. You have followed the incident-handling process to manage events and incidents. You identify a Denial of Service attack (DOS) originating from a network connected to your internal enterprise network. Which phase of the incident-handling process should you follow next to handle this incident?

Explanation

After an incident is identified, containment is the next response phase. It limits ongoing damage and prevents the denial-of-service attack from further affecting connected enterprise resources; recovery occurs only after containment and remediation activities.

Learn more

NIST SP 800-61 Rev. 2, Computer Security Incident Handling Guide

CISSP-ISSAP: Information Systems Security Architecture Professional

AstroTutor

Notes

Readiness

QuestionQ157

Community Discussion