5.4 Map Elements to These Steps of Analysis Based on the NIST.SP800-61 200-201 Practice Questions (Page 7)

Questions 31–32

1. 31foundation · easy

   According to NIST SP 800-61, which activity is part of the post-incident analysis (lessons learned) phase?

   • AAcquiring incident response tools
   • BDocumenting lessons learned from the incident
   • CValidating alerts from monitoring tools
   • DIsolating the affected systems
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   According to NIST SP 800-61, which activity is part of the preparation phase of incident response?

   • AIsolating affected systems from the network
   • BConducting a lessons-learned meeting
   • CValidating alerts from monitoring tools
   • DForming a computer security incident response team (CSIRT)
   Reveal Solution Discussion Select an answer first