Which two actions should be taken during the preparation phase of the incident response life cycle defined by NIST? (Choose two.)
- Fully analyze the incident.
- Create and train the CSIRT.
- Detect all the incidents that occurred.
- Acquire and deploy the tools that are needed to investigate incidents.
- Meet with all involved parties to discuss the incident that took place.
|
Explanation & Hint: According to the guideline defined in the NIST Incident Response Life Cycle, several actions should be taken during the preparation phase including (1) creating and training the CSIRT and (2) acquiring and deploying the tools needed by the team to investigate incidents. |