The incident response team has turned the evidence over to the forensic team. Now, it is the time to begin looking for the ways to improve the incident response process for next time. What are the…

The correct answer is A. Information dissemination policy B. Additional personnel security controls C. Incident response plan D. Electronic monitoring statement. The post-incident lessons-learned phase should comprehensively evaluate all aspects of the response process to identify gaps and drive improvements. All four listed options represent valid and distinct areas that should be reviewed after an incident is resolved.

Advanced Incident Response & Digital Forensics Fundamentals

Question

The incident response team has turned the evidence over to the forensic team. Now, it is the time to begin looking for the ways to improve the incident response process for next time. What are the typical areas for improvement? Each correct answer represents a complete solution. Choose all that apply.

Options

AInformation dissemination policy
BAdditional personnel security controls
CIncident response plan
DElectronic monitoring statement

How the community answered

(33 responses)

A
100% (33)

Why each option

The post-incident lessons-learned phase should comprehensively evaluate all aspects of the response process to identify gaps and drive improvements. All four listed options represent valid and distinct areas that should be reviewed after an incident is resolved.

AInformation dissemination policyCorrect

BAdditional personnel security controlsCorrect

CIncident response planCorrect

DElectronic monitoring statementCorrect

Concept tested: Post-incident lessons learned and process improvement areas

Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf

Topics

#incident response#post-incident review#IR process improvement#lessons learned

Community Discussion

No community discussion yet for this question.

Full GCFA Practice