CISM Question 359

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose D3

  See the first sentence of CISM Exam Guide regarding Eradication " The eradication phase of security incident response is concerned with the removal of the agent or factors that caused or aided the incident." . Doing a root cause is part of the activities but the overall goal is removal/ wiping.

• 1

  During the Eradication phase root cause analysis should be done

• 1

  4.12.1 CISM REVIEW 16: A,B and D are correct anwers.