nerdexam
EC-Council

312-38 · Question #12

Which of the following is a process that detects a problem, determines its cause, minimizes the damages, resolves the problem, and documents each step of response for future reference?

The correct answer is A. Incident response. Incident response (A) is the formal, end-to-end process that encompasses detection, root cause analysis, damage containment, resolution, and post-incident documentation - matching every element listed in the question exactly. Incident handling (B) refers specifically to the…

Incident Response and Business Continuity

Question

Which of the following is a process that detects a problem, determines its cause, minimizes the damages, resolves the problem, and documents each step of response for future reference?

Options

  • AIncident response
  • BIncident handling
  • CIncident management
  • DIncident planning

How the community answered

(47 responses)
  • A
    94% (44)
  • B
    4% (2)
  • C
    2% (1)

Explanation

Incident response (A) is the formal, end-to-end process that encompasses detection, root cause analysis, damage containment, resolution, and post-incident documentation - matching every element listed in the question exactly.

  • Incident handling (B) refers specifically to the tactical, hands-on actions taken during an incident (containment, eradication, recovery), but it is a subset of incident response, not the full lifecycle.
  • Incident management (C) is a broader IT service management term (often from ITIL) focused on restoring normal service operations quickly, with less emphasis on root cause analysis or forensic documentation.
  • Incident planning (D) is not a standard industry term for this process - planning is a preparatory phase, not a reactive process.

Memory tip: Think of Response as the word that "responds to everything" - it covers the full story from detection to documentation. If the question lists a complete, step-by-step lifecycle, the answer is almost always incident response.

Topics

#incident response#incident detection#containment#documentation

Community Discussion

No community discussion yet for this question.

Full 312-38 Practice