nerdexam
GIAC

GCIH · Question #231

Which of the following are used to identify who is responsible for responding to an incident?

The correct answer is D. Incident response policies. Incident response policies define organizational roles, responsibilities, and authority for who must respond to a given incident.

Incident Response & Cyber Kill Chain

Question

Which of the following are used to identify who is responsible for responding to an incident?

Options

  • ADisaster management policies
  • BIncident response manuals
  • CDisaster management manuals
  • DIncident response policies

How the community answered

(21 responses)
  • B
    5% (1)
  • C
    5% (1)
  • D
    90% (19)

Why each option

Incident response policies define organizational roles, responsibilities, and authority for who must respond to a given incident.

ADisaster management policies

Disaster management policies address large-scale business continuity and disaster recovery scenarios, not the assignment of incident response roles.

BIncident response manuals

Incident response manuals provide step-by-step procedural guidance on how to handle incidents, not who holds responsibility for responding.

CDisaster management manuals

Disaster management manuals describe recovery procedures for major disruptions and are not used to identify incident response responsibilities.

DIncident response policiesCorrect

Incident response policies are high-level governance documents that establish authority, define roles and responsibilities, and identify which personnel or teams are accountable for responding to specific categories of incidents. Unlike manuals, policies carry organizational authority and are the primary reference for determining responsibility rather than procedure.

Concept tested: Incident response policy vs. manual governance

Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf

Topics

#incident response policies#IR governance#responsibility assignment

Community Discussion

No community discussion yet for this question.

Full GCIH Practice