Study. uk . com
  1. Home
  2. All questions
  3. Question 71

CISSP study material · question 71 of 500

A skilled intruder held access to a domain member server for weeks, and the full set of techniques they used remains unknown. The team plans to rebuild the server from a backup taken before the earliest known activity. Which three actions should the recovery include? Choose three.

  1. Examine the restoration media for corruption and attacker artefacts before any rebuild starts
  2. Return the server to production as soon as restoration finishes and watch its traffic for recurrence
  3. Re-scan the rebuilt server and remediate the underlying cause before it carries production traffic
  4. Consider replacing the physical hardware because the adversary's full technique set stays unknown
Show the answer

Answer: A. Examine the restoration media for corruption and attacker artefacts before any rebuild starts
C. Re-scan the rebuilt server and remediate the underlying cause before it carries production traffic
D. Consider replacing the physical hardware because the adversary's full technique set stays unknown

Backup media can carry corruption or attacker artefacts, the rebuilt asset needs rescanning and root-cause remediation before production, and unknown adversary techniques can justify swapping the hardware itself.

Source: NIST SP 800-61 Rev. 3 (NIST) — SP 800-61r3 > Section 3.2, RC and RC.RP-03/RC.RP-05

Challenge yourself on this topic → Study as cards