Exam 200-201 topic 1 question 108 discussion

The incident response process typically includes the following phases: preparation, detection and analysis, containment, eradication, and recovery. The detection and analysis phase is focused on identifying and assessing the scope and severity of the incident, and this includes analyzing logs and other data to identify the source and nature of the attack.

Supposed to be A

D should be the answer.

these questions are tricky but the key here " researches an attacking host through logs in a SIEM?" -- This should be done in Detection and Analysis -- A

A is correct answer. Preparation --> Detection and Analysis --> Containment, Eradication and Recovery --> Post-Incident Activity

Identifying the attacking host is done during containment so the correct answer is "D"

It is done during Containment, eradication and recovery which is considered a single phase. As per the course guide "Containment, Eradication, and Recovery The containment, eradication, and recovery phase includes the following activities: ■ Gathering and handling evidence ■ Identifying the attacking hosts ■ Choosing a containment strategy to effectively contain and eradicate the attack, as well as to successfully recover from it"

https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf section 3.3.3 shows "Identifiing the Attacking Hosts" under "Containment, Eradication, and Recovery"

From Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide chapter 8 page 303 The containment, eradication, and recovery phase includes the following activities: ■ Gathering and handling evidence ■ Identifying the attacking hosts ■ Choosing a containment strategy to effectively contain and eradicate the attack, as well as to successfully recover from it

Preparation --> Detection and Analysis --> Containment, Erradicaion and Recovery --> Post-Incident Activity Detection and Analysis --> Profile networks and systems, Understand normal behaviors, Create a log retention policy, Perform event correlation. Maintain and use a knowledge base of information.Use Internet search engines for research. Run packet sniffers to collect additional data. Filter the data. Seek assistance from others. Keep all host clocks synchronized. Know the different types of attacks and attack vectors. Develop processes and procedures to recognize the signs of an incident. Understand the sources of precursors and indicators. Create appropriate incident documentation capabilities and processes. Create processes to effectively prioritize security incidents. Create processes to effectively communicate incident information (internal and external communications). Ref: Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide