A hotel guest Wi-Fi controller looks compromised, and that controller holds the only copy of the day's logs. What should the team protect while containing the device?
Select an answer to reveal the explanation.
Short Explanation
Photograph the muddy footprints before you mop, or the only record goes out with the water. You still need the controller's logs for the handling plan, so you keep a copy before any wipe. The trap is wiping first, skipping containment, or posting the logs for guests.
Full Explanation
A preserved copy of the logs the handling plan still needs, made before any wipe is what you protect while containing. The controller is the only place those logs exist, and the handling plan still needs them, so a copy has to come off the box before a wipe or rebuild destroys that copy. Containment can follow immediately after the copy is safely stored. An immediate wipe of the controller so an intruder cannot copy the logs off the device removes the intruder's path to the logs by also destroying the only copy the plan needs, so the investigation loses the record it has not yet preserved. A choice to skip containment and leave the controller online until guest checkout leaves a controller that looks compromised in service, which skips the containment the situation calls for once the logs are safe to remove. Publication of the day's logs on the guest portal so readers anywhere can open them spreads the logs to anyone who can open the guest portal. Publication is not preservation, and it exposes operational detail the hotel did not intend to share. Exam caveat: NIST SP 800-61 Rev. 3 maps the familiar handling phases onto CSF 2.0 Functions, and the exam still expects you to keep evidence the plan needs during containment rather than treating those four phase names as Rev. 3's only model. Operational check: copy the day's logs off the controller, hash that copy so its integrity can be shown, and store it away from the controller before you wipe or rebuild the device.