According to SANS and the GIAC GSLC material, after confirmation, the immediate focus should be on ‘Short-Term Containment’. This involves quick actions to prevent the incident from expanding, such as isolating a network segment, before a more permanent and thorough ‘Containment’ strategy is developed and executed. Eradication, evidence collection, and recovery are subsequent phases.

The contents of RAM (Random Access Memory) are the most volatile, as they are lost when power is removed. Following the order of volatility, it should be captured first in a live system forensic process. Network connection tables are also volatile but typically persist longer than RAM contents. System logs and configuration files on disk are non-volatile by comparison.

While the other options may be beneficial outcomes, the fundamental goal of a security awareness program is to foster a sustainable security culture. This means moving beyond checkbox compliance to instill a mindset where employees understand risks and see themselves as active participants in protecting organizational assets.

Separation of Duties is designed to prevent fraud by requiring more than one person to complete a critical task. Here, a single individual can both create a fake vendor and approve payments to that vendor, creating a high risk of fraudulent payments. This control failure is a classic example of a lack of SoD. Collusion requires two people, and the other options are less severe or direct consequences.

NAC acting in this manner is a preventive control. It aims to stop a potential problem (a vulnerable device connecting) before it can occur, by enforcing a security policy (updated AV) at the point of entry. Corrective controls fix issues after detection, detective controls identify incidents, and compensating controls are alternatives when primary controls aren’t feasible.

Inherent risk is the raw, untreated level of risk associated with an activity or process before any actions (controls) are taken to mitigate it. It answers the question, “How risky is this if we do nothing?” Residual risk is the risk remaining after controls. The other options describe residual risk or other concepts.

A SOC 2 Type I report describes a service organization’s system and assesses the suitability of the design of its controls at a specific point in time. A SOC 2 Type II report goes further to also audit the operating effectiveness of those controls over a period (usually 6-12 months). SOC 1 deals with financial reporting, and GDPR compliance is a separate framework.

A core principle of data lifecycle management, especially for sensitive data, is to minimize retention. Data should only be kept as long as there is a clear legal, regulatory, or business need. Indefinite or excessively long retention increases the risk of exposure through breaches or mishandling. The specific duration is defined by legal/operational requirements, not a fixed arbitrary period.

The ‘Protect’ function is focused on developing and implementing safeguards to ensure delivery of critical services and to limit the impact of a potential event. This includes access control, awareness training, data security, and protective technology. ‘Identify’ helps understand risk, ‘Detect’ enables discovery, and ‘Respond’ involves actions taken after an incident.

According to SANS and the GIAC GSLC material, after confirmation, the immediate focus should be on ‘Short-Term Containment’. This involves quick actions to prevent the incident from expanding, such as isolating a network segment, before a more permanent and thorough ‘Containment’ strategy is developed and executed. Eradication, evidence collection, and recovery are subsequent phases.0