Exam SY0-501 topic 1 question 720 discussion

PICER-L Preparation Identification Containment Eradacation Recovery Lessons Learned

key word here is "instructed to act upon on a fast spreading virus" with the options of answers available, identification is the first step in responding to the incidence with assumption that preparation was done already.

I'd pick D, just saying. iphy is right about, "instructed to act upon a fast spreading virus" but one thing he was wrong on, this is one of two component of containment definition NOT the definition of identification. Now, when looking at the NIST, this also can be defined as an active identification, but I'm thinking CompTIA would add the word active since this is a reading comprehension certification, but who knows.... "Containment. Malware incident containment has two major components: stopping the spread of malware and preventing further damage to hosts. Nearly every malware incident requires containment actions. In addressing an incident, it is important for an organization to decide which methods of containment to employ initially, early in the response." "(Chief Information Security Officer) Typically, the job title of the person with overall responsibility for INFORMATION ASSURANCE assurance and systems security. Sometimes referred to as Chief Information Officer (CIO)". Link Below - NIST 800-83 Rev.1 document/PDF https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.sp.800-83r1.pdf

how does the CISO know its a virus? its already been identified as such. "act upon" tells me containment should be answer. because otherwise, you should go back to the very start, preparation. if i can't assume identification has been done, why are you assuming preparation has been done .

CISO find out there is a virus but don't know what type is it,so let identified which virus is it.

Which systems have the virus, what is the damage done, which segment of the network is this on this all = identification which hasn't been done yet

I originally chose C, but now I'm thinking the answer is A as the team would first have to identify what systems are infected by the virus.

D. Containment. It's a fast spreading virus, after all.

is it Escalation?

Wouldn't this be containment since it was already identified by the CISO?