When an incident occurs, which of the following is NOT a primary responsibility of an organization's incident response team?

Question

Options

• ADetermining whether any confidential information has been compromised over the course of the
• BCommunicating with top management regarding the circumstances of the cybersecurity event
• CDetermining the scope of the damage caused by the incident
• DImplementing the recovery procedures necessary to restore security and recover from any

• A
  5% (2)
• B
  90% (36)
• C
  3% (1)
• D
  3% (1)

Explanation

The incident response (IR) team's primary responsibilities are technical and operational: identifying whether confidential data was compromised (A), determining the scope of damage (C), and implementing recovery procedures (D). Communicating with top management (B) is typically the responsibility of the CISO, a designated spokesperson, or a management liaison - not the IR team itself. The IR team focuses on containment, analysis, and recovery, while executive communication is a management function to avoid distracting the technical team during an active incident.

No community discussion yet for this question.