A CSIRT Has Completed Restoration Procedures Related to a Breach

question 561

Multiple Choice

A CSIRT has completed restoration procedures related to a breach of sensitive data is creating documentation used to improve the organization's security posture. The team has been specifically tasked to address logical controls in their suggestions. Which of the following would be MOST beneficial to include in lessons learned documentation? (Choose two.)

• A) A list of policies, which should be revised to provide better clarity to employees regarding acceptable use
• B) Recommendations relating to improved log correlation and alerting tools
• C) Data from the organization's IDS/IPS tools, which show the timeline of the breach and the activities executed by the attacker
• D) A list of potential improvements to the organization's NAC capabilities, which would improve AAA within the environment
• E) A summary of the activities performed during each phase of the incident response activity
• F) A list of topics that should be added to the organization's security awareness training program based on weaknesses exploited during the attack

---

Definitions:

Suicide And Self-injury

Actions that involve attempting to cause one's own death or deliberate harm to oneself without suicidal intent, respectively.

Canadians

Citizens of Canada, a country in North America known for its diverse culture and landscapes.

Dissociative Identity Disorder

A complex psychological condition characterized by the presence of two or more distinct personality states or identities within a single individual, often a result of severe trauma.

Coexistence

The state or condition of living in harmony and peace with others, despite differences.