CISM · Question #212
Post-incident analysis of a recent security incident revealed that although the incident was identified in a timely manner, assigning it to the correct team took longer than expected and led to greate
The correct answer is C. Improve the incident triage process.. The post-incident analysis pinpointed a specific breakdown: the handoff from detection to the correct team was slow, causing greater impact. Improving the incident triage process directly addresses this identified bottleneck. Implementing a SIEM (A) would enhance detection capabi
Question
Post-incident analysis of a recent security incident revealed that although the incident was identified in a timely manner, assigning it to the correct team took longer than expected and led to greater impact. Which of the following should be done FIRST to prevent a recurrence in the future?
Options
- AImplement a SIEM solution.
- BImprove documentation of lessons learned.
- CImprove the incident triage process.
- DDocument incident prevention and containment steps.
How the community answered
(26 responses)- A4% (1)
- B12% (3)
- C81% (21)
- D4% (1)
Explanation
The post-incident analysis pinpointed a specific breakdown: the handoff from detection to the correct team was slow, causing greater impact. Improving the incident triage process directly addresses this identified bottleneck. Implementing a SIEM (A) would enhance detection capability, but detection was already working well. Documenting lessons learned (B) records what happened but does not fix the process. Documenting prevention and containment steps (D) targets different phases than the one that failed. The fix must match the root cause.
Topics
Community Discussion
No community discussion yet for this question.