Study. uk . com
  1. Home
  2. All questions
  3. Question 496

CompTIA Security+ study material · question 496 of 611

An engineer wants to reimage an infected server immediately to remove the malware. Why does NIST place containment before eradication?

  1. Because eradication cannot begin until the attacker is identified
  2. Because containment restores service faster
  3. Because eradication requires management approval
  4. Because stopping the spread is more urgent, and rushing to clean destroys evidence
Show the answer

Answer: D. Because stopping the spread is more urgent, and rushing to clean destroys evidence

Containment buys time and preserves the record that eradication and notification will both depend on.

Source: NIST SP 800-61 Rev. 2 (NIST) — SP 800-61 Rev. 2 § 3.3 Containment, Eradication, and Recovery

Challenge yourself on this topic → Study as cards