In the Middle of a Cyberattack, a Security Engineer Removes

question 5

Multiple Choice

In the middle of a cyberattack, a security engineer removes the infected devices from the network and locks down all compromised accounts. In which of the following incident response phases is the security engineer currently operating?

• A) Identification
• B) Preparation
• C) Lessons learned
• D) Eradication
• E) Recovery
• F) Containment