CISSP-ISSMP: Information Systems Security Management Professional

Question

You work as a Senior Marketing Manager for Umbrella Inc. You discover that some software applications on the systems are malfunctioning, and you are also unable to access your remote desktop session. You suspect that a malicious attack was carried out on the company network. You immediately call the incident response team to handle the situation, and they ask the Network Administrator to obtain all relevant information about the malfunctioning.

The Network Administrator tells the incident response team that he was reviewing network security, which caused all of these problems. The incident response team declares that this was a controlled event, not an incident. Which step of the incident-handling process did the incident response team perform?

Explanation

Identification involves collecting and analyzing information to determine whether a suspected security event is an actual incident. Establishing that the disruption was caused by an authorized security review classifies it as a controlled event rather than an incident.

Learn more

NIST SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management

CISSP-ISSMP: Information Systems Security Management Professional

AstroTutor

Notes

Readiness

QuestionQ33

Community Discussion