Which task describes threat attribution?
- reporting the incident to the proper authorities
- determining who is responsible for the attack
- obtaining the most volatile evidence
- evaluating the server alert data
Explanation: Threat attribution refers to determining the individual, organization, or nation responsible for a successful intrusion or attack incident. The security investigation team correlates all the evidence in order to identify commonalities between tactics, techniques, and procedures (TPPs) for known and unknown threat actors.
Related exam: CyberOps Associate (Version 1.0) - Module 28: Digital Forensics and Incident Analysis and Response Answers
Related exam: Cyber Threat Management - Checkpoint Exam: Incident Response Answers
Related exam: Cybersecurity Essentials - Checkpoint Exam: Incident Response (Module 27 Exam)
Related exam: Cybersecurity Essentials My Knowledge Check Answers
