Exam CFR-310 topic 1 question 83 discussion

A. Identification Explanation: The actions described—running antivirus scans, checking department membership, reviewing HIPS alerts, and monitoring network activity—are all part of the identification phase. In this phase, the goal is to determine whether an incident has occurred, the scope of the issue, and which systems are affected. Incorrect Responses: B. Preparation: This involves setting up tools and processes before an incident, not responding to an ongoing issue. C. Recovery: This phase comes after the incident has been contained and eradicated, focusing on restoring systems and services. D. Containment: This involves stopping the spread of the issue or mitigating its impact, which hasn't occurred yet in the actions described.