Which of the following is the MOST likely reason for invoking the incident response plan?

The correct answer is B. Unexpected network traffic originating from the demilitarized zone (DMZ). The most likely reason for invoking the incident response plan would be unexpected network traffic originating from the demilitarized zone (DMZ). The DMZ is a critical part of the network infrastructure, often exposed to external traffic, and unexpected traffic from it could…

Submitted by thandi_sa· Apr 18, 2026Information Security Incident Management

Question

Options

AMultiple failed login attempts on an employee workstation
BUnexpected network traffic originating from the demilitarized zone (DMZ)
CAnti-malware alert detected on an employee workstation
DPort scans detected on an externally facing system

How the community answered

(56 responses)

A
18% (10)
B
71% (40)
C
4% (2)
D
7% (4)

Explanation

The most likely reason for invoking the incident response plan would be unexpected network traffic originating from the demilitarized zone (DMZ). The DMZ is a critical part of the network infrastructure, often exposed to external traffic, and unexpected traffic from it could indicate a serious compromise or breach that needs immediate attention.

Topics

#Incident Response Plan#Threat Detection#DMZ Security#Incident Escalation

Community Discussion

No community discussion yet for this question.

Full CISM Practice