hard20 pts · first answer countsincident-responsecontainmentscoping

Contain now or watch first

You found one attacker foothold but suspect more. Watching may reveal the rest, but the attacker could steal data meanwhile. When is it reasonable to monitor before containing?

A.Always, because watching is always better than containingB.When risk of harm is low and monitoring is strong, for a short agreed periodC.Never, because containing at once is always the right choiceD.Only when the attacker has asked for more time

Discussion 0

Join free to post in the discussion.

Contain now or watch first

Discussion 0

Related questions