A post-incident review revealed that key stakeholders took longer than acceptable to decide whether an application should be shut down following a security breach. Which of the following is…

Question

Options

• AEstablish containment procedures.
• BReview escalation procedures.
• CUpdate incident response classification.
• DRequire frequent incident response training.

• A
  2% (1)
• B
  77% (40)
• C
  13% (7)
• D
  8% (4)

Explanation

Reviewing escalation procedures directly addresses the root cause: stakeholders lacked a clear, timely path to reach decision-makers with the authority to act. Escalation procedures define who gets notified, when, and in what order - a gap here explains exactly why the shutdown decision stalled.

Why the distractors fail:

• A (Containment): Containment limits the spread of a breach but doesn't govern the decision-making chain - the breach was already contained enough to raise a shutdown question.
• C (Incident classification): Classification helps prioritize severity triage upfront, but the problem here occurred after the incident was already recognized - at the decision layer, not the categorization layer.
• D (Training): Training improves general preparedness but won't fix a structurally broken or undefined escalation path; you can't train people to follow a process that doesn't exist.

Memory tip: When the question describes slow decisions by stakeholders, think "escalation" - escalation procedures own the who-decides-and-when problem. Containment = stop the damage; escalation = reach the right people fast.

No community discussion yet for this question.