312-39 · Question #88
James Rodriguez has recently taken over as the lead SOC manager at GlobalTech Dynamics. The team is deploying a $2M SOC facility, creating incident response playbooks, running tabletop exercises…
The correct answer is C. Preparation. These activities fall under Preparation because they are about building readiness before incidents occur. Preparation includes developing and documenting playbooks, establishing tooling and infrastructure (SOC facility, monitoring platforms), training staff, defining roles and…
Question
James Rodriguez has recently taken over as the lead SOC manager at GlobalTech Dynamics. The team is deploying a $2M SOC facility, creating incident response playbooks, running tabletop exercises, and training a 15-member incident response team to handle alerts and incidents efficiently. In the Incident Response process flow, which phase best aligns with these activities?
Options
- ARecovery
- BIncident recording and assignment
- CPreparation
- DIncident triage
How the community answered
(41 responses)- A2% (1)
- B7% (3)
- C88% (36)
- D2% (1)
Explanation
These activities fall under Preparation because they are about building readiness before incidents occur. Preparation includes developing and documenting playbooks, establishing tooling and infrastructure (SOC facility, monitoring platforms), training staff, defining roles and escalation paths, and exercising procedures through tabletop simulations. The goal is to ensure that when incidents happen, the SOC and incident response teams can respond quickly, consistently, and effectively. Recovery occurs after an incident to restore systems. Incident recording and assignment is the operational step of logging and routing a specific incident. Incident triage is the rapid assessment of a specific alert to determine severity and next actions. None of those are the focus here; the scenario is clearly about capability building and readiness. From a SOC maturity perspective, strong preparation reduces response time, minimizes confusion during high-stress events, improves coordination across teams, and enhances compliance posture by demonstrating that the organization has defined and tested incident handling procedures.
Topics
Community Discussion
No community discussion yet for this question.