Which of the following processes determines whether an event gets classified as an incident?

The correct answer is B. Triage. Triage is the process that evaluates and classifies events to determine whether they rise to the level of an incident - it involves assessing severity, scope, and impact to decide how (or whether) to escalate and respond. Why the distractors are wrong: A (Threat intelligence revi

Submitted by anjalisingh· Apr 18, 2026Information Security Incident Management

Question

Options

AThreat intelligence reviews
BTriage
CBusiness impact analysis (BIA)
DEnd-user reporting

How the community answered

(23 responses)

B
91% (21)
C
4% (1)
D
4% (1)

Explanation

Triage is the process that evaluates and classifies events to determine whether they rise to the level of an incident - it involves assessing severity, scope, and impact to decide how (or whether) to escalate and respond.

Why the distractors are wrong:

A (Threat intelligence reviews) provide context about known threats and adversaries but don't classify individual events as incidents.
C (Business Impact Analysis) is a planning activity used to identify critical business functions and recovery priorities - it's done before incidents occur, not during event classification.
D (End-user reporting) is an input that may surface potential events, but reporting alone doesn't classify anything; that determination requires triage.

Memory tip: Think of triage like an ER nurse deciding who needs a doctor vs. who can wait - events pile up constantly, and triage is the gatekeeping step that separates noise from real incidents.

Topics

#Incident classification#Triage#Incident handling#Incident response process

Community Discussion

No community discussion yet for this question.

Full CISM Practice