Study. uk . com
  1. Home
  2. All questions
  3. Question 501

CompTIA Security+ study material · question 501 of 611

A responder spends hours attributing the attacking IP address during an active intrusion. What is NIST's guidance on this?

  1. Attribution is required before containment can begin
  2. Attribution must be completed for the notification
  3. Attribution determines the containment strategy
  4. Identifying the attacking host is often a poor use of response time
Show the answer

Answer: D. Identifying the attacking host is often a poor use of response time

It rarely changes what the responder should do next, and the time is better spent on containment and recovery.

Source: NIST SP 800-61 Rev. 2 (NIST) — SP 800-61 Rev. 2 § 3.3.3 Identifying the Attacking Hosts

Challenge yourself on this topic → Study as cards