What is the last step he should list?

Malone is finishing up his incident handling plan for IT before giving it to his boss for review. He is outlining the incident response methodology and the steps that are involved.

What is the last step he should list?
A . Assign eradication.
B . Recovery
C . Containment
D . A follow-up.

View Answer

Answer: D

Explanation:

The last step Malone should list in his incident handling plan is ‘A follow-up’. This step is crucial as it involves analyzing the incident to understand how it occurred and what can be done to prevent similar incidents in the future. It often includes a review of the effectiveness of the response, identification of lessons learned, updating policies and procedures accordingly, and conducting training sessions if necessary. This step ensures that the organization improves its security posture and is better prepared for future incidents.

Reference: The follow-up step is aligned with the incident response life cycle which includes preparation, identification, containment, eradication, recovery, and then follow-up as the final phase. This is consistent with the best practices in incident response and is covered in the Certified Network Defender (CND) curriculum as well as in the NIST guidelines on incident response1.