alleryStart learning →How does the incident handling guide define an event?
AAny occurrence with a negative consequence
BAny violation of a computer security policy
CAny imminent threat of a policy violation
DAny observable occurrence in a system or network
Answer & Solution
Correct answer: D. Any observable occurrence in a system or network
1. Section 2.1 defines three related terms in sequence, and the first is the broadest.
2. "An event is any observable occurrence in a system or network." The examples given are deliberately mundane: a user connecting to a file share, a server receiving a request for a web page, a user sending email, a firewall blocking a connection attempt.
3. So an event carries no judgement about whether anything bad happened. Most events are entirely ordinary.
4. An occurrence with a negative consequence is the definition of an *adverse event*, the next term up, with examples such as system crashes and packet floods.
5. A violation, or an imminent threat of a violation, of security policy is the definition of a computer security *incident*, the narrowest of the three.
_Source: NIST SP 800-61 Rev. 2 "Computer Security Incident Handling Guide" (Aug 2012), section 2.1 "Events and Incidents"_
Keep practising Incident Response Life Cycle
Browse all Incident Response Life Cycle questions for BCA Cyber Security, or explore more Cybersecurity topics.
Related questions
Order the incident response stagesKnock out the false precursor linesWhich of the following does the guide NOT list among its criteria for choosing a containmeAntivirus software alerts that a host is infected with malware. In the incident handling gIn the incident handling guide's terms, what is a precursor?