English
Menu

Cyber Attacks and Defense in Practice

The second revision (Rev. 2) of SP 800-61, the incident response guide published by the US NIST in 2012, presents incident response as a cycle of four phases. Which of the following gives the phases in the correct order?

  1. ADetection and analysis → preparation → post-incident activity → containment, eradication and recovery
  2. BPreparation → detection and analysis → containment, eradication and recovery → post-incident activity
  3. CContainment, eradication and recovery → preparation → detection and analysis → post-incident activity
Show answer and explanation

Answer: B. Preparation → detection and analysis → containment, eradication and recovery → post-incident activity

SP 800-61 Rev. 2 presents four phases: "preparation", which sets up the organization, procedures and tools; "detection and analysis", which judges from alerts and logs whether something is an incident and estimates its impact; "containment, eradication and recovery", which stops the damage from spreading, removes the cause and restores operations; and "post-incident activity", which organizes the lessons learned for next time. There is back-and-forth between detection and analysis and containment, eradication and recovery, and the lessons from post-incident activity are fed back into preparation to improve detection rules and procedures. The third revision (Rev. 3), published in April 2025, reorganized the guidance around the functions of NIST's Cybersecurity Framework (CSF) 2.0, but the four-phase model is still widely used.

  • A. Preparation is needed before detection, and post-incident activity is carried out at the end of the response.
  • B. Correct. It starts with preparation, and the lessons from post-incident activity are used in the next preparation.
  • C. Containment is carried out after detection and analysis have determined that there is an incident.
Practice this topic Back to topic

Books on Cyber Attacks and Defense in Practice Ad

As an Amazon Associate I earn from qualifying purchases.

More Cyber Attacks and Defense in Practice questions

  1. Evidence for an investigation is to be collected from a server where an incident occurred. Which of the following orders is the most appropriate according to the principle of collecting evidence in order of how easily it is lost (order of volatility)?
  2. Evidence from an incident investigation, such as a copy of a disk, is to be handled so that it can later be used in litigation or in a report to the police. Which of the following handling is the most appropriate according to the idea of chain of custody?
  3. Which of the following correctly describes the IoC (indicator of compromise) and IoA (indicator of attack) used in threat detection?
  4. Which of the following correctly describes the difference in roles between a CSIRT and a PSIRT set up within an organization?
  5. The logs of two servers are being compared in an intrusion investigation. The web server logs in Coordinated Universal Time (UTC), and its clock was set correctly by NTP. The file server logs in Japan time (UTC+9 hours), and its clock was 4 minutes ahead of the correct time. The web server log records a suspicious login at 01:52 (UTC), and the file server log records a mass read of files at 10:58 (Japan time). How many minutes after the suspicious login did the file reads actually happen?

Comparisons in this topic