Which type of evidence supports a theory or an assumption that results from initial evidence?
Which two elements of the incident response process are stated in NIST Special Publication 800-61 r2?
(Choose two.)
A security analyst notices a sudden surge of incoming traffic and detects unknown packets from unknown senders After further investigation, the analyst learns that customers claim that they cannot access company servers According to NIST SP800-61, in which phase of the incident response process is the analyst?
A user received a malicious attachment but did not run it.
Which category classifies the intrusion?
