Study. uk . com
  1. Home
  2. All questions
  3. Question 419

CISSP study material · question 419 of 500

A reader complains that Revision 3 of the incident response guidance no longer explains how to perform containment or eradication. What reason does the document give?

  1. Those activities apply only to federal systems and were removed for general audiences.
  2. Those activities are considered proprietary to commercial response providers.
  3. Those activities moved to the configuration management guidance instead.
  4. The details change too often and vary too much across technologies and organisations to be captured in a static publication.
Show the answer

Answer: D. The details change too often and vary too much across technologies and organisations to be captured in a static publication.

Revision 3 changed scope because the details of performing response change so often and vary so widely that a static publication cannot keep them current.

Source: NIST SP 800-61 Rev. 3 (NIST) — SP 800-61r3 > 1.1 Purpose and Scope

Challenge yourself on this topic → Study as cards