ITPEC FE Morning April 2021 Question 40
A cybersecurity incident response plan is defined as a set of instructions to aid the cybersecurity team to detect, respond to, and recover from cybersecurity incidents. The cybersecurity incident response plan resolves issues, such as cybercrime, data loss, and service outages that threaten daily work. Which of the following is part of the cybersecurity incident response plan?
Explanation
Containment — limiting the spread and damage of an incident is one of the phases of an incident response plan.
A typical plan runs through preparation, detection and analysis, containment, eradication, recovery and a lessons-learned review. Containment comes as soon as an incident is confirmed: isolating infected machines, disabling compromised accounts or blocking attacker addresses, so the damage stops growing while the cause is removed.
Answer (b)
Why not others:
- •(a) — attacking systems with scripts is what an attacker does; the plan responds to it
- •(c) — social engineering, tricking people into giving up information or access, is an attack technique
- •(d) — stealing user credentials is an attacker's goal and a common cause of incidents, not a response step
Key rule: An incident response plan is made of defensive steps: detect, contain, eradicate, recover and learn; any option describing an attack cannot be one of them.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.