Which of the following is MOST important to complete during the recovery phase of an incident response process before bringing affected systems back online?
A.
Test and verify that compromised systems are clean.
B.
Document recovery steps for senior management reporting.
C.
Record and close security incident tickets.
D.
Capture and preserve forensic images of affected systems.
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Josef4CISM
1 month, 1 week ago