MENU
A member of the SOC team is checking the dashboard provided by the Cisco Firepower Manager for further Isolation actions. According to NIST SP800-61, in which phase of incident response is this action?
Suggested Answer: D
Get Premium 200-201 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
According to NIST SP800-61, the incident response lifecycle consists of four phases: Preparation, Detection and Analysis, Containment, Eradication and Recovery, and Post-Incident Activity.
When a SOC team member checks the Cisco Firepower Manager dashboard for further isolation actions, they are working within the Eradication and Recovery phase.
This phase focuses on removing the threat from the environment and recovering affected systems to normal operations.
NIST SP800-61 Computer Security Incident Handling Guide
Incident Response Phases Explained
Role of SOC in Incident Response
40 comments · newest first
KE
Kerrie
11 months ago
NIST guidelines can be tricky, but I think it's A.
WI
Willard
11 months ago
Wait, are we sure it's not the recovery phase?
CE
Celeste
11 months ago
Agree, it's all about analyzing the incident!
CA
Carin
11 months ago
I thought it was the Preparation phase?
RO
Ronnie
12 months ago
It's definitely the Cost-incident activity phase.
RO
Roxane
12 months ago
This question reminds me of a practice one we did on incident response phases. I think it’s definitely not the preparation phase, but I’m torn between the cost-incident activity and the recovery phase.
SC
Scot
1 year ago
I’m a bit confused here. I thought the preparation phase was more about setting up defenses rather than responding to incidents.
ED
Eden
1 year ago
I remember studying the phases, and I feel like checking the dashboard is more about analyzing the situation, so maybe it's the selection and analyze phase?
AH
Ahmad
1 year ago
I think this might be related to the containment part of the incident response, which could be in the recovery phase? But I'm not entirely sure.
HY
Hyun
1 year ago
Okay, let me see. The SOC team is checking the dashboard and considering further isolation actions, so that sounds like it could be the Containment phase. I'll go with that unless I can think of a better option.
LA
Lanie
1 year ago
Hmm, I'm not sure about this one. The phases of incident response can be tricky to remember. I'll have to think through the NIST framework carefully to determine the right answer.
VE
Veronika
1 year ago
This question seems straightforward. I think the answer is Containment phase, since the SOC team is taking action to isolate the incident.
PA
Pamella
1 year ago
Ugh, I always get the incident response phases mixed up. Is this the Preparation phase or the Containment phase? I need to review those NIST guidelines again before the exam.
RY
Ryann
2 years ago
Selection and analyze phase? Nah, that's more like what you'd do after the incident, not during the immediate response.
AN
Annabelle
2 years ago
Hope the SOC team isn't trying to 'cost-incident' their way out of this one. That would be a real doozy!
VE
Velda
2 years ago
A: Definitely, rushing into it could make things worse.
LA
Lazaro
2 years ago
A: Agreed, rushing into things could make the situation worse.
NI
Nieves
2 years ago
B: Yeah, they need to carefully analyze the data before taking any further actions.
JE
Jean
2 years ago
B: Yeah, they need to carefully analyze the data before taking any further actions.
RE
Refugia
2 years ago
A: I think they are in the Selection and analyze phase.
JE
Jeffrey
2 years ago
A: I think they are in the Selection and analyze phase.
SH
Shizue
2 years ago
I'm going with B) Preparation phase. Monitoring the dashboard is definitely part of getting ready to respond to an incident.
CL
Clorinda
2 years ago
I'm leaning towards D) The radiation and recovery phase. Once we isolate the threat, we need to focus on recovery and preventing future incidents.
WI
Wilda
2 years ago
I see your point, but I still think B) Preparation phase is the best fit. We need to be prepared before taking any further actions.
LU
Luis
2 years ago
I think it could also be C) Selection and analyze phase. We need to analyze the data on the dashboard to make informed decisions.
CA
Catherin
2 years ago
I agree, B) Preparation phase makes sense. It's all about being ready for any incidents.
EL
Elly
2 years ago
I'm not sure, but I think it could also be D) The radiation and recovery phase, as they are taking actions to isolate and recover from the incident.
AN
An
2 years ago
The Radiation and Recovery phase? Really? That sounds more like what you'd do after a nuclear incident, not a cybersecurity event.
LO
Louisa
2 years ago
C: Actually, it's in the Cost-incident activity phase.
RO
Rosann
2 years ago
B: No, I believe it's in the Preparation phase.
ON
Ona
2 years ago
D: I'm pretty sure it's in the Radiation and Recovery phase.
AL
Allene
2 years ago
C: Are you sure? I thought it was in the Cost-incident activity phase.
SE
Serita
2 years ago
B: No, I believe it's in the Preparation phase.
OZ
Ozell
2 years ago
A: I think it's in the Selection and analyze phase.
BE
Bernadine
2 years ago
A: I think it's actually in the Selection and analyze phase.
AG
Agustin
2 years ago
Hmm, this seems to be in the Preparation phase. Checking the dashboard to prepare for further action is a key part of that.
TI
Timothy
2 years ago
I agree, checking the dashboard is crucial for preparing for further actions.
ST
Steffanie
2 years ago
Yes, you're right. It's definitely in the Preparation phase.
RE
Rebbecca
2 years ago
I agree with Audra, because in this phase the SOC team is analyzing the data to make informed decisions.
AU
Audra
2 years ago
I think the answer is C) Selection and analyze phase.