ExamTopics Logo
Mail Us[email protected]
Menu
Eccouncil Discussions
exam questions

Exam 212-89 All Questions

View all questions & answers for the 212-89 exam
Go to Exam

Exam 212-89 topic 1 question 39 discussion

Actual exam question from ECCouncil's 212-89
Question #: 39
Topic #: 1
[All 212-89 Questions]

The data on the affected system must be backed up so that it can be retrieved if it is damaged during incident response. The system backup can also be used for further investigations of the incident. Identify the stage of the incident response and handling process in which complete backup of the infected system is carried out?

  • A. Containment
  • B. Eradication
  • C. Incident recording
  • D. Incident investigation
Show Suggested Answer Hide Answer
Suggested Answer: A 🗳️
by Hems85 at April 2, 2022, 9:34 p.m.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
whuut
1 week, 1 day ago
Selected Answer: A
Backup is Part of Containment--- As the question state backup will be used for investigation. You do backup during containment to preserve evidence.
upvoted 1 times
...
b127bb
1 year ago
Selected Answer: A
A is Confirmed - forensic backup process is part of the containment phase.
upvoted 1 times
...
Gianmm99
1 year, 7 months ago
Selected Answer: A
A is correct answer - module 2, pg 315
upvoted 2 times
...
Anzk
1 year, 11 months ago
answer id D
upvoted 1 times
...
Anzk
1 year, 11 months ago
A is correct answer - module 2, pg 315
upvoted 1 times
...
Ijoakob
3 years, 6 months ago
Must be A , common tecniques of contaiment, Moule 2 page 250
upvoted 4 times
...
Hems85
3 years, 7 months ago
Should be C - Incident recording.
upvoted 1 times
s3curity00
3 years, 4 months ago
No. Incident recording is just plain recording. Backups aren't being taken during recording of the incident. It's taken under the containment phase as backups can be used for further investigation if needed and if there is something we need to restore.
upvoted 1 times
...
s3curity01
3 years, 4 months ago
Incident recording only records/collects information about the incident which is to be sent to IR department for analysis and validation. No other activities are to be performed especially taking backups, which is being done on containment phase.
upvoted 2 times
...
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel