Exam CAS-004 topic 1 question 96 discussion

Preparation -> Detection -> Analysis -> Containment -> Eradication -> Recovery -> Lessons learned The SOC has been notified, so preparation and detection is complete. Analysis was done in identifying the file and the origin of attack. Next step is to contain.

Obviously next step is to contain the threat.

Containment Steps for a CSIRT via NIST 800-53 1. Identify - what's on your network and vulnerabilities there are 2. Protect - Setup controls and mitigate them with technical controls (patching, segmentation, ACL's, least privilege) Setup administrative controls via Continous monitoring (CONMON) and processes Detect - Alert triggers via an event, triage to verify if false positive or true positive Respond - isolate (contain) the issue from spreading, remove the infection Recover - Restore systems, update lessons learned Source: https://www.nist.gov/cyberframework/online-learning/five-functions Source: Verifying each answer against Chat GPT, my experience, other test banks, a written book, and weighing in the discussion from all users to create a 100% accurate guide for myself before I take the exam. (It isn't easy because of the time needed, but it is doing my diligence)

Containment

Next is to "Containment" the issue.

'Containment' is correct.