Exam 212-89 All Questions

View all questions & answers for the 212-89 exam

Exam 212-89 topic 1 question 39 discussion

Actual exam question from ECCouncil's 212-89

Question #: 39
Topic #: 1

The data on the affected system must be backed up so that it can be retrieved if it is damaged during incident response. The system backup can also be used for further investigations of the incident. Identify the stage of the incident response and handling process in which complete backup of the infected system is carried out?

A. Containment
B. Eradication
C. Incident recording
D. Incident investigation

Show Suggested Answer

Suggested Answer: A 🗳️

by Hems85 at April 2, 2022, 9:34 p.m.

Comments

Submit Cancel

b127bb

6 months, 2 weeks ago

Selected Answer: A

A is Confirmed - forensic backup process is part of the containment phase.

upvoted 1 times

...

Gianmm99

1 year, 1 month ago

Selected Answer: A

A is correct answer - module 2, pg 315

upvoted 2 times

...

[Removed]

1 year, 2 months ago

Answer is A page 249 to 250

upvoted 1 times

...

Anzk

1 year, 5 months ago

answer id D

upvoted 1 times

...

Anzk

1 year, 5 months ago

A is correct answer - module 2, pg 315

upvoted 1 times

...

Ijoakob

3 years, 1 month ago

Must be A , common tecniques of contaiment, Moule 2 page 250

upvoted 4 times

...

Hems85

3 years, 2 months ago

Should be C - Incident recording.

upvoted 1 times

s3curity00

2 years, 11 months ago

No. Incident recording is just plain recording. Backups aren't being taken during recording of the incident. It's taken under the containment phase as backups can be used for further investigation if needed and if there is something we need to restore.

upvoted 1 times

...

s3curity01

2 years, 10 months ago

Incident recording only records/collects information about the incident which is to be sent to IR department for analysis and validation. No other activities are to be performed especially taking backups, which is being done on containment phase.

upvoted 2 times

...