CYBR 4330 Chapter 8 Exam Questions and Answers

CYBR 4330 Chapter 8 Exam Questions and Answers Introduction - Answer-•After an incident has been contained and system control has been regained, incident recovery can begin. •As in the response phase, the first task is to inform the appropriate people—most importantly, executive management. •Almost simultaneously, the CSIRT must assess the full extent of the damage to determine what must be done to restore the systems. •The CSIRT must also examine the appropriate systems and network logs and try to determine exactly how the attack began and spread; as individuals begin recovery operations based on the IR plan. incident damage assessment - Answer-•Recovery from an incident or incidents begins with what , which can take days or weeks, depending on the extent of the damage. The initial determination of the scope of the breach of CIA of info and assets can range from minor to major Recovery - Answer-•Recovery from an incident or incidents begins with incident damage assessment, which can take days or weeks, depending on the extent of the damage. •The organization ensures that the appropriate systems and data recovery procedures are initiated, working to restore all systems from backup to usable condition. •Concurrently, teams begin investigating what happened and how, trying to determine how the attack began and spread throughout the organization's systems.