200-201 Question 153

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A1

  The answer is A for sure. "detection and analysis": This phase involves validating an incident and performing "scoping." To effectively move to the next phase, responders must first identify all compromised systems to ensure no part of the attack is left unaddressed

• Chose D1

  Nella A si ha un sospetto , ma la domanda dice che già si sa che c'è stato un attacco e quindi la D è corretta perchè si controllano tutti gli host infetti per contenere, eliminare ecc

• 1

  A. detection and analysis In the incident response process, the step that includes identifying all hosts affected by an attack is typically part of the "detection and analysis" phase. During this phase, security teams analyze the detected incident, assess the scope of the attack, and work to identify all systems and hosts that may have been affected. This step is crucial for understanding the extent of the incident and planning the appropriate response actions.