フリー問題

問題文

An engineer has to settle how a compromised host is cut off while the evidence on it is kept usable, if the host also runs work the firm has to keep going. Which reading does the forensic integration guide support, and what does it ask the firm to weigh beforehand?

選択肢

1. The analyst settles the containment decision alone and tells the incident response team afterwards, the decision resting on the reading of the danger with the standing policy set aside, so that the strategy cuts the danger with the standing of the evidence left out of it, and the firm weighs afterwards what a strategy has cost it, since taking a critical system offline to gather disk images holds up little of the work, and it often opens the machine and its store to the staff at large while the gathering runs, in that containment-cost weighing.
2. The analyst works with the incident response team on the containment decision, and the decision rests on the standing policy together with the team's reading of the danger, so that the strategy cuts the danger while keeping the standing of the evidence where it can, and the firm weighs afterwards what a strategy has cost it, since taking a critical system offline to gather disk images holds up little of the work, and it often opens the machine and its store to the staff at large while the gathering runs, in that containment-cost weighing.
3. The analyst settles the containment decision alone and tells the incident response team afterwards, the decision resting on the reading of the danger with the standing policy set aside, so that the strategy cuts the danger with the standing of the evidence left out of it, and the firm weighs beforehand what a strategy would cost it, since taking a critical system offline for hours to gather disk images may hold up the work it has to do, and it often fences off the machine and holds access down to authorized staff while the gathering runs, in that containment-cost weighing.
4. The analyst works with the incident response team on the containment decision, and the decision rests on the standing policy together with the team's reading of the danger, so that the strategy cuts the danger while keeping the standing of the evidence where it can, and the firm weighs beforehand what a strategy would cost it, since taking a critical system offline for hours to gather disk images may hold up the work it has to do, and it often fences off the machine and holds access down to authorized staff while the gathering runs, in that containment-cost weighing.