An organization has had six security incidents over the past year against their main web application. Each time the organization was able to determine the cause of the incident and restore…

Question

Options

• ACreate security metrics that provide information on response times and requirements to determine
• BConduct a loss analysis to determine which systems to focus time and money towards increasing
• CImplement a knowledge management process accessible to the help desk and finance departments
• DDevelop an incident response team, require training for incident remediation, and provide incident

• A
  8% (2)
• B
  4% (1)
• C
  13% (3)
• D
  75% (18)

Explanation

Developing a formal incident response (IR) team, providing required training on incident remediation, and creating standardized IR documentation (playbooks, runbooks, escalation procedures) is the most comprehensive approach to reducing recovery time. A trained, practiced team with documented procedures can respond faster and more consistently than ad hoc efforts. Option A (security metrics) helps measure performance but does not directly improve response capability. Option B (loss analysis) helps prioritize investments but doesn't build response capability. Option C (knowledge management accessible to help desk and finance) is too limited in scope and does not address the full incident response lifecycle.

No community discussion yet for this question.