An organization has recently adjusted its security stance in response to online threats made by a known hacktivist group. Which term defines the initial event in the NIST SP800- 61 r2?
A. instigator
B. precursor
C. online assault
D. trigger
Which term defines the initial event in the NIST SP800- 61 r2?
Precursor: A sign that an attacker may be preparing to cause an incident.
A ?? instigator, does not exist in the NIST SP800- 61 r2, the correct is B
as per NIST the answer is B…apparently the one going to mark our exams are CISCO who referenced all in thier trainings and guidelines and NIST also…so what is in the marking scheme is B…I choose B!!
#my_thoughts
Signs of an incident fall into one of two categories: precursors and indicators. A precursor is a sign that an incident may occur in the future. An indicator is a sign that an incident may have occurred or may be occurring now.
Answer = B
Correct answer is B. In NIST SP800- 61 r2 there are only two events Precursor or indicators.
Most attacks do not have any identifiable or detectable precursors from the target’s perspective. If
precursors are detected, the organization may have an opportunity to prevent the incident by altering its
security posture to save a target from attack
SO B
@T-ro: I’ve literally searched the word “trigger” in the NIST document and there’s nothing as such. @Cornholio gives the exact content of the document. Answer should be B.
ok, after reviewing and researching I’ve determined that this question is a little tricky. NIST only lists two events. It suggests that PRECURSORS are the start of a malicious event. However, cyber security reports and documents that I’ve read all state that an initial event is called a TRIGGER.
Actually, the answer is D
Answer is B
@ AJ please provide your source for Precursor
http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
p 26
Signs of an incident fall into one of two categories: precursors and indicators. A precursor is a sign that
an incident may occur in the future. An indicator is a sign that an incident may have occurred or may be
occurring now.