Exam 210-255 topic 1 question 32 discussion

Actual exam question from Cisco's 210-255

Question #: 32
Topic #: 1

[All 210-255 Questions]

What is accomplished in the identification phase of incident handling?

A. determining the responsible user
B. identifying source and destination IP addresses
C. defining the limits of your authority related to a security event
D. determining that a security even has occurred

Show Suggested Answer

Suggested Answer: D 🗳️
In the identification phase you need to work out whether you are dealing with an event or an incident. This is where understanding your environment is critical as it means looking for significant deviations from "normal" traffic baselines or other methods.

by anonymous1966 at July 25, 2020, 8:15 p.m.