GIAC Exam GCED Topic 5 Question 2 Discussion

Actual exam question for GIAC's GCED exam

Question #: 2
Topic #: 5

An incident response team is handling a worm infection among their user workstations. They created an IPS signature to detect and block worm activity on the border IPS, then removed the worm's artifacts or workstations triggering the rule. Despite this action, worm activity continued for days after. Where did the incident response team fail?

AThe team did not adequately apply lessons learned from the incident

BThe custom rule did not detect all infected workstations

CThey did not receive timely notification of the security event

DThe team did not understand the worm's propagation method

Show Suggested Answer

Suggested Answer: B

Identifying and scoping an incident during triage is important to successfully handling a security incident. The detection methods used by the team didn't detect all the infected workstations.

by Charlene at May 09, 2022, 06:41 AM

Limited Time Offer

25%

Off

Get Premium GCED Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Currently there are no comments in this discussion, be the first to comment!