According to the NIST Incident Handling Guide, what is the next phase of this investigation?

An analyst received a ticket regarding a degraded processing capability for one of the HR department’s servers. On the same day, an engineer noticed a disabled antivirus software and was not able to determine when or why it occurred.

According to the NIST Incident Handling Guide, what is the next phase of this investigation?
A . Recovery
B. Detection
C. Eradication
D. Analysis

View Answer

Answer: B

Explanation:

Reference: https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.sp.800-61r2.pdf