CyberCertPrepOT Security FundamentalsOT Fundamentals: Incident Response & ForensicsEASYFree question
In the NIST SP 800-61 lifecycle which phase combines stopping the spread of an incident with removing the cause?
- A.Containment eradication recovery phase
- B.Preparation planning phase
- C.Detection analysis phase
- D.Post-incident activity phase
Why A is correct
NIST SP 800-61 Rev 2 groups containment, eradication and recovery into a single phase between detection and the post-incident review. Preparation and detection are before it and lessons learned come after.
Know someone studying for OT Security Fundamentals? Send them this one.