Isaca Cybersecurity-Audit-Certificate Exam - Topic 1 Question 21 Discussion

Actual exam question for Isaca's Cybersecurity-Audit-Certificate exam

Question #: 21
Topic #: 1

[All Cybersecurity-Audit-Certificate Questions]

During which incident response phase is evidence obtained and preserved?

ALessons learned

BContainment

CEradication

DRecovery

Show Suggested Answer

Suggested Answer: C

A firewall is a network security device that monitors and controls incoming and outgoing network traffic based on predetermined security rules. It establishes a barrier between a secure internal network and an untrusted external network, such as the internet. This system is designed to prevent unauthorized access to or from private networks and is a fundamental piece of a comprehensive security framework for any organization.

by Sylvie at Jul 11, 2024, 05:08 PM

Limited Time Offer

25%

Off

Get Premium Cybersecurity-Audit-Certificate Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Clemencia

7 months ago

Really? I had no idea it was that early in the process.

upvoted 0 times

...

Ricki

8 months ago

Nope, definitely containment. That's where it all starts!

upvoted 0 times

...

Rickie

8 months ago

Wait, I thought it was the eradication phase?

upvoted 0 times

...

Carey

8 months ago

Totally agree, containment is key for preserving evidence!

upvoted 0 times

...

Queen

8 months ago

It's during the containment phase that evidence is collected.

upvoted 0 times

...

Michell

9 months ago

I feel like it has to be containment, since that’s when you’re actively dealing with the incident and need to preserve what you find.

upvoted 0 times

...

Carman

9 months ago

I’m a bit confused; I thought evidence gathering happened in the recovery phase, but that doesn’t seem right now.

upvoted 0 times

...

William

9 months ago

I remember practicing a question about incident response phases, and I think it was during the eradication phase when evidence is preserved.

upvoted 0 times

...

Melynda

9 months ago

I think evidence is usually collected during the containment phase, but I'm not entirely sure.

upvoted 0 times

...

Paulina

9 months ago

I'm pretty confident that evidence collection and preservation happens during the investigation phase, which is part of the overall incident response process. That's when you're gathering information and documenting what happened.

upvoted 0 times

...

Inocencia

9 months ago

I'm a little unsure about this one. Is evidence collection and preservation part of the eradication phase, where you're trying to remove the root cause of the incident? Or is it during the recovery phase, when you're restoring normal operations? I'll have to review my notes on the incident response lifecycle.

upvoted 0 times

...

Marisha

9 months ago

Ah, I've got this! Evidence collection and preservation happens during the containment phase of the incident response process. That's when you're trying to stop the bleeding and secure the affected systems.

upvoted 0 times

...

Kanisha

9 months ago

Okay, let me think this through. I know evidence collection and preservation is a critical part of the incident response process, but I'm not sure which specific phase it falls under. I'll have to think about this one.

upvoted 0 times

...

Jonelle

9 months ago

Hmm, this seems like a pretty straightforward incident response question. I think the key is to remember the different phases and what happens in each one.

upvoted 0 times

...

Viva

9 months ago

Okay, I've got this. The first step is to deter potential threats, so I'll go with C. Deter.

upvoted 0 times

...

Soledad

9 months ago

I think I know this one - a spin-off allows investors to better value the demerged business, so I'll go with option C.

upvoted 0 times

...

Tricia

9 months ago

I'm not entirely sure how to break down the labor costs since some were overtime and others weren't. I remember similar questions though about identifying controllable costs.

upvoted 0 times

...