An engineer discovered a breach, identified the threat's entry point, and removed access. The engineer was able to identify the host, the IP address of the threat actor, and the application the threat actor targeted. What is the next step the engineer should take according to the NIST SP 800-61 Incident handling guide?
A) Recover from the threat.
B) Analyze the threat.
C) Identify lessons learned from the threat.
D) Reduce the probability of similar threats.

Question

Quizplus · Accepted Answer

According to the NIST SP 800-61 Incident Handling Guide, after containing the threat, the next step is to analyze the threat to understand its nature and impact before moving on to recovery and lessons learned.

An Engineer Discovered a Breach, Identified the Threat's Entry Point