Cybersecurity and Response Planningintermediate
Place the following steps for investigating and responding to an automated security alert in the correct chronological order.
Answer
A monitoring tool generates an alert for suspicious activity, An analyst investigates contextual logs and related host telemetry, The analyst determines whether the activity is a true incident or a false positive, The incident response team initiates containment and remediation actions
Explanation
### The order
1. **A tool raises an alert**: monitoring surfaces a possible concern.
2. **An analyst reviews context and related observations**: context can distinguish unusual normal activity from suspicious behavior.
3. **The analyst determines whether the alert indicates an incident**: classification follows investigation.
4. **Responders take suitable action if warranted**: response follows evidence-based assessment.
### Remember
An alert begins investigation; it does not end it.
Related Questions
- Which of the following is an example of an adversary attack activity, as opposed to a system vulnerability or a defensive measure? (Select all that apply.)(intermediate)
- Which information is most directly useful when coordinating technical response across teams?(basic)
- Attackers necessarily complete all life-cycle stages quickly, so extended monitoring is unnecessary.(basic)
- The foundational three-stage model of organizational change consisting of Unfreeze, Change, and Refreeze was introduced by social psychologist Kurt _____.(basic)
- Select ALL elements that belong in a documented cyber risk assessment.(intermediate)
Want to practice more questions like this?
Join myBenkio free and practice past questions for your Nigerian university courses with AI explanations for every answer.
Start Practicing Free