A security team conducts a lessons-learned meeting after struggling to determine who should conduct the next steps following a security event. Which of the following should the team create to…

The correct answer is C. Incident response plan. An incident response plan (IRP) is a document that defines the roles and responsibilities, procedures, and guidelines for responding to a security incident. It helps the security team to act quickly and effectively, minimizing the impact and cost of the incident. An IRP should…

Submitted by javi_es· Mar 6, 2026Incident Response and Management

Question

A security team conducts a lessons-learned meeting after struggling to determine who should conduct the next steps following a security event. Which of the following should the team create to address this issue?

Options

AService-level agreement
BChange management plan
CIncident response plan
DMemorandum of understanding

How the community answered

(31 responses)

A
6% (2)
B
3% (1)
C
90% (28)

Explanation

An incident response plan (IRP) is a document that defines the roles and responsibilities, procedures, and guidelines for responding to a security incident. It helps the security team to act quickly and effectively, minimizing the impact and cost of the incident. An IRP should specify who should conduct the next steps following a security event, such as containment, eradication, recovery, and analysis.

Topics

#incident response plan#roles and responsibilities#lessons learned

Community Discussion

No community discussion yet for this question.

Full CS0-003 Practice