300-215 · Question #93
A security team is discussing lessons learned and suggesting process changes after a security breach incident. During the incident, members of the security team failed to report the abnormal system…
The correct answer is A. Introduce a priority rating for incident response workloads. D. Create an executive team delegation plan. During the post-incident activity phase, it is critical to analyze lessons learned and update processes to ensure quicker and more efficient response in the future. Introducing a priority rating for incident response workloads (A) helps address the issue of team members being…
Question
A security team is discussing lessons learned and suggesting process changes after a security breach incident. During the incident, members of the security team failed to report the abnormal system activity due to a high project workload. Additionally, when the incident was identified, the response took six hours due to management being unavailable to provide the approvals needed. Which two steps will prevent these issues from occurring in the future? (Choose two.)
Options
- AIntroduce a priority rating for incident response workloads.
- BProvide phishing awareness training for the full security team.
- CConduct a risk audit of the incident response workflow.
- DCreate an executive team delegation plan.
- EAutomate security alert timeframes with escalation triggers.
How the community answered
(20 responses)- A65% (13)
- B10% (2)
- C20% (4)
- E5% (1)
Explanation
During the post-incident activity phase, it is critical to analyze lessons learned and update processes to ensure quicker and more efficient response in the future. Introducing a priority rating for incident response workloads (A) helps address the issue of team members being occupied with other tasks and unable to prioritize abnormal system activity. This ensures incidents are handled based on severity, not just workload. Creating an executive team delegation plan (D) addresses the issue of delays due to unavailability of management for approvals. It ensures alternative decision-makers are available for swift action.
Topics
Community Discussion
No community discussion yet for this question.