Exam 350-201 topic 1 question 33 discussion

According to the NIST incident handling guide, the steps for handling an incident include preparation, detection and analysis, containment, eradication, recovery, and post-incident activity12. In the scenario described, the incident response team has detected the malware, eradicated it by removing the malware, and recovered by restoring the functionality and data of infected systems. However, the step of containment, which should occur before eradication and recovery to prevent the spread of malware and further damage, appears to have been missed. Containment strategies are crucial to limit the scope and magnitude of an incident1.

Correct answer is A

D. Perform vulnerability assessment. After removing the malware and restoring the functionality and data of infected systems, the incident response team should perform a vulnerability assessment to identify the root cause of the incident and any other potential vulnerabilities that could lead to future incidents. This step is important to prevent future incidents and to improve the incident handling capability of the organization. Containment (A) is the initial step in the incident response process, and installing IPS software (B) can be a part of the containment or mitigation phase, depending on the specific incident. Determining the escalation path (C) is an important step in incident response, but it is not directly related to the handling of the current incident. Therefore, performing a vulnerability assessment (D) is the step that was missed in the incident response scenario according to the NIST incident handling guide. - ChatGPT

A, contain the malware https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.sp.800-61r2.pdf

Correct answer is A.

Containment was missed https://www.cynet.com/incident-response/nist-incident-response/

Yep Contain step is missing here. Answer is A

The fact that it says "IR team was notified" makes me think there has always been an escalation path. They removed the malware (eradicate) but did they fully contain it, could it happen again? I think its A.

C. Determine the escalation path