alleryStart learning →In the incident handling guide's terms, what is a precursor?
AA sign that an incident may occur in the future
BA sign that an incident may be occurring now
CA sign that an incident has been contained
DA sign that an alert was a false positive
Answer & Solution
Correct answer: A. A sign that an incident may occur in the future
1. Section 3.2.2 splits the signs of an incident into two categories and defines both in adjacent sentences.
2. "A precursor is a sign that an incident may occur in the future."
3. "An indicator is a sign that an incident may have occurred or may be occurring now."
4. So the whole distinction is tense: a precursor points forward, an indicator points at the present or the recent past.
5. The practical value of a precursor is stated in the same section: if one is detected, "the organization may have an opportunity to prevent the incident by altering its security posture", or at minimum to watch the target more closely.
6. A false positive is a different idea again, defined in the sources table as an alert indicating malicious activity "when in fact there has been none".
_Source: NIST SP 800-61 Rev. 2 "Computer Security Incident Handling Guide" (Aug 2012), section 3.2.2 "Signs of an Incident"_
Keep practising Incident Response Life Cycle
Browse all Incident Response Life Cycle questions for BCA Cyber Security, or explore more Cybersecurity topics.
Related questions
Order the incident response stagesKnock out the false precursor linesWhich of the following does the guide NOT list among its criteria for choosing a containmeAntivirus software alerts that a host is infected with malware. In the incident handling gHow does the incident handling guide define an event?