Exam 200-201 topic 1 question 108 discussion

The incident response process typically includes the following phases: preparation, detection and analysis, containment, eradication, and recovery. The detection and analysis phase is focused on identifying and assessing the scope and severity of the incident, and this includes analyzing logs and other data to identify the source and nature of the attack.

Supposed to be A

D should be the answer.

these questions are tricky but the key here " researches an attacking host through logs in a SIEM?" -- This should be done in Detection and Analysis -- A

A is correct answer. Preparation --> Detection and Analysis --> Containment, Eradication and Recovery --> Post-Incident Activity

sorry NIST SP 800-61...

According to NIST SP 800-31 3.3 Identifying the Attacking Hosts - incident handlers should generally stay focused on containment, eradication, and recovery. Could be C and D

Identifying the attacking host is done during containment so the correct answer is "D"

It is done during Containment, eradication and recovery which is considered a single phase. As per the course guide "Containment, Eradication, and Recovery The containment, eradication, and recovery phase includes the following activities: ■ Gathering and handling evidence ■ Identifying the attacking hosts ■ Choosing a containment strategy to effectively contain and eradicate the attack, as well as to successfully recover from it"

page 303 in cyberops book, states Containment, eridacation and recovery, - identify the attacking host,,, which is bad wording because that means answer could be containment or eradication since they are both possible answers. horrible test writing for cisco here .

https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf section 3.3.3 shows "Identifiing the Attacking Hosts" under "Containment, Eradication, and Recovery"

From Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide chapter 8 page 303 The containment, eradication, and recovery phase includes the following activities: ■ Gathering and handling evidence ■ Identifying the attacking hosts ■ Choosing a containment strategy to effectively contain and eradicate the attack, as well as to successfully recover from it

Preparation --> Detection and Analysis --> Containment, Erradicaion and Recovery --> Post-Incident Activity Detection and Analysis --> Profile networks and systems, Understand normal behaviors, Create a log retention policy, Perform event correlation. Maintain and use a knowledge base of information.Use Internet search engines for research. Run packet sniffers to collect additional data. Filter the data. Seek assistance from others. Keep all host clocks synchronized. Know the different types of attacks and attack vectors. Develop processes and procedures to recognize the signs of an incident. Understand the sources of precursors and indicators. Create appropriate incident documentation capabilities and processes. Create processes to effectively prioritize security incidents. Create processes to effectively communicate incident information (internal and external communications). Ref: Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide