What is the main purpose of the Incident Response Team?

Question

Options

• AEnsure efficient recovery and reinstate repaired systems
• BCreate effective policies detailing program activities
• CCommunicate details of information security incidents
• DProvide current employee awareness programs

• A
  71% (34)
• B
  8% (4)
• C
  4% (2)
• D
  17% (8)

Explanation

An Incident Response Team (IRT) exists primarily to manage and recover from security incidents - their core mission is restoring systems to normal operation as quickly and safely as possible after a breach or disruption, making A correct.

• B is wrong because policy creation is the responsibility of security management or governance bodies, not the IRT. The IRT follows policies; it doesn't write them.
• C is wrong because while the IRT does communicate during an incident, communication is a supporting activity, not the primary purpose. That role belongs more to PR/legal or a CISO function.
• D is wrong because security awareness training is owned by HR or a security awareness program - the IRT is reactive (handles live incidents), not proactive training staff.

Memory tip: Think of the IRT like firefighters - their job is to respond and restore, not write fire codes (policy), hold press conferences (communicate), or teach fire safety classes (awareness). When you see "Incident Response," think "fix and recover."

No community discussion yet for this question.