CISM · Question #446
Which of the following should be the FIRST step after identifying a potential security breach at a cloud service provider?
The correct answer is D. Validate the breach with the provider. A 'potential' breach is unconfirmed. Before escalating to senior management (A), activating response plans (B), or invoking the BCP (C), the organization must first confirm whether an actual breach occurred by engaging directly with the cloud provider. Acting on an unvalidated…
Question
Which of the following should be the FIRST step after identifying a potential security breach at a cloud service provider?
Options
- ANotify senior management.
- BFollow the provider's response plan.
- CRefer to the organization's business continuity plan (BCP).
- DValidate the breach with the provider.
How the community answered
(25 responses)- A4% (1)
- B12% (3)
- C4% (1)
- D80% (20)
Explanation
A 'potential' breach is unconfirmed. Before escalating to senior management (A), activating response plans (B), or invoking the BCP (C), the organization must first confirm whether an actual breach occurred by engaging directly with the cloud provider. Acting on an unvalidated event wastes resources, may trigger unnecessary alarm, and can undermine credibility. Validation establishes the facts needed to decide which downstream steps are appropriate and with what urgency.
Topics
Community Discussion
No community discussion yet for this question.