nerdexam
EC-Council

312-50V11 · Question #708

John is an incident handler at a financial institution. His steps in a recent incident are not up to the standards of the company. John frequently forgets some steps and procedures while handling resp

The correct answer is D. Create an incident checklist. Creating an incident response checklist gives John a quick, reusable reference during high-stress incidents with minimal ongoing administrative overhead.

Information Security and Ethical Hacking Fundamentals

Question

John is an incident handler at a financial institution. His steps in a recent incident are not up to the standards of the company. John frequently forgets some steps and procedures while handling responses as they are very stressful to perform. Which of the following actions should John take to overcome this problem with the least administrative effort?

Options

  • AIncrease his technical skills
  • BRead the incident manual every time it occurs
  • CSelect someone else to check the procedures
  • DCreate an incident checklist

How the community answered

(24 responses)
  • A
    4% (1)
  • C
    4% (1)
  • D
    92% (22)

Why each option

Creating an incident response checklist gives John a quick, reusable reference during high-stress incidents with minimal ongoing administrative overhead.

AIncrease his technical skills

Increasing technical skills addresses knowledge gaps but does not directly solve the problem of forgetting procedural steps during high-stress situations.

BRead the incident manual every time it occurs

Reading the full incident manual each time an incident occurs is significantly more time-consuming and administratively burdensome than consulting a concise checklist.

CSelect someone else to check the procedures

Assigning someone else to verify procedures adds a dependency on another person's availability and introduces coordination overhead, increasing rather than reducing administrative effort.

DCreate an incident checklistCorrect

An incident checklist is a one-time artifact that can be referenced during every future incident without requiring additional effort per occurrence. It directly addresses the problem of forgetting steps under stress by providing a structured, step-by-step prompt that aligns with NIST SP 800-61 best practices for incident response procedures.

Concept tested: Incident response procedural documentation and checklists

Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf

Topics

#incident response#incident checklist#incident handling#security procedures

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V11 Practice