Study. uk . com
  1. Home
  2. All questions
  3. Question 64

CISSP study material · question 64 of 500

Ransomware is confirmed on three file servers, and the response team has isolated all three. Management asks the team to state how large the incident is before recovery planning begins. Which action best establishes the true scope of the incident?

  1. Sweep hosts that have drawn no alerts for compromise indicators and attacker persistence footholds
  2. Interview the owners of the three servers to confirm which other systems share their business function
  3. Accept the correlation that grouped the three servers into one incident and record that as the scope
  4. Submit the malware sample to a vendor to learn how many hosts that family typically infects
Show the answer

Answer: A. Sweep hosts that have drawn no alerts for compromise indicators and attacker persistence footholds

Scoping means hunting indicators and persistence on machines nobody has flagged yet; limiting the search to already-known victims understates the incident and leaves the intruder working elsewhere unobserved.

Source: NIST SP 800-61 Rev. 3 (NIST) — SP 800-61r3 > Section 3.2, RS.AN-08

Challenge yourself on this topic → Study as cards