問題文
A reviewer has to write down where a handling team should keep its attention while an incident is running, if the owners of the system are pressing to have the attacking host named. Which reading does NIST SP 800-61 support, and what does it say a reply from that address settles?
選択肢
- The team should stay on naming and tracing the attacking host before anything else, since the address behind it points to the whole of the harm and the first goal is to have the wrongdoer known, and silence from the apparent address settles that the address was faked rather than that a host there quietly ignores probes, in that attention-priority rule.
- The team should stay on naming and tracing the attacking host before anything else, since the address behind it points to the whole of the harm and the first goal is to have the wrongdoer known, and a reply from the apparent address settles that the address is real rather than that a host there answers probes, in that attention-priority rule.
- The team should stay on shutting the incident in, clearing it away and putting the service back, since naming the attacking host can eat time and come to nothing while the first goal is to hold the harm to the business down, and a reply from the apparent address settles for certain that the address is real rather than that a host there answers probes, in that attention-priority rule.
- The team should stay on shutting the incident in, clearing it away and putting the service back, since naming the attacking host can eat time and come to nothing while the first goal is to hold the harm to the business down, and a reply from the apparent address settles that a host there answers probes rather than that the address is real, in that attention-priority rule.