Cisco Updated 200-201 Exam Questions and Answers by nolan

In the context of NIST SP800-61, a precursor is an event that indicates the potential occurrence of an incident. When an organization adjusts its security stance in response to online threats made by a known hacktivist group, the initial event—the threats—would be considered a precursor. It is an indication of a potential future attack or security incident34.

References :=

• NIST SP 800-61 Rev. 2, Computer Security Incident Handling Guide3.
• Computer Security Incident Handling Guide - NIST

X.509 certificates are used in conjunction with secure data transfer protocols to ensure the confidentiality and integrity of communication. They are part of a public key infrastructure (PKI) that authenticates the identity of entities and encrypts data in transit. References: Implementing X.509 certificates along with secure data transfer protocols like SFTP, HTTPS, FTPS, and IPSec can help secure data sharing with third-party companies

According to NIST SP800-61, the incident response phase called “Containment, Eradication, and Recovery” involves containing the incident, eradicating the threat, and recovering from the incident2. In the scenario described, the engineer worked on containing the DDoS attack by identifying the attacker and the technique used, which is part of the containment process. The recommendation to implement Blackhole filtering is part of the eradication process, where measures are taken to prevent the attack from happening again. Finally, restoring the server is part of the recovery process, where normal operations are resumed. Therefore, the engineer finished work during the “Containment, Eradication, and Recovery” phase. References: NIST SP800-61 Computer Security Incident Handling Guide2.