During which of the following phases should an incident response team document actions required to remove the threat that caused the incident?
During which of the following phases should an incident response team document actions required to remove the threat that caused the incident?
During the Eradication phase, the incident response team focuses on removing the threat and restoring affected systems. This phase requires documentation of actions taken to eliminate the cause of the incident, such as applying patches, removing malware, closing vulnerabilities, or blocking access points. Proper documentation is crucial for ensuring the steps are recorded for future reference and for updating incident response procedures.
you make the document during eradication because it is most needed then, it is reviewed during incident review to improve the incident response plan
A. Eradication. During the Eradication phase of the incident response process, the focus is on removing the threat, eliminating any traces of the attacker, and restoring affected systems to their normal state. This phase involves taking specific actions to remediate the cause of the incident, such as applying patches, removing malware, closing vulnerabilities, or blocking access points used by the attacker. Documentation of the actions taken during the Eradication phase is crucial for several reasons. It helps ensure that the steps taken are properly recorded for future reference and can be used to update incident response procedures.
document is need for review.
Eradication - Eradication is the phase of effective incident response that entails removing the threat and restoring affected systems to their previous state, ideally while minimizing data loss.
The eradication phase is when the incident response team takes steps to remove the threat that caused the incident. This may include removing malware, patching vulnerabilities, or changing passwords. The team should document all actions taken during this phase so that they can be reviewed and improved upon in the future.
A. Eradication
I'm not too fond of the question, it says document actions, not the actions to remove the threat. It is to document. I feel like D more than A.