GCIH · Question #373
Which of the following is ALWAYS a good guideline for incident response processes?
The correct answer is D. If resources allow, assign a helper to the primary incident responder. Assigning a helper to the primary incident responder is a sound best practice because it reduces errors, provides peer oversight, and eliminates single points of failure in the response process.
Question
Which of the following is ALWAYS a good guideline for incident response processes?
Options
- AInformation regarding the incident should be provided to anyone who asks
- BRequire the incident handler to work alone in order to preserve evidence integrity
- CInformation regarding the incident should only be known by the primary incident responder
- DIf resources allow, assign a helper to the primary incident responder
How the community answered
(29 responses)- B3% (1)
- C3% (1)
- D93% (27)
Why each option
Assigning a helper to the primary incident responder is a sound best practice because it reduces errors, provides peer oversight, and eliminates single points of failure in the response process.
Sharing incident information with anyone who asks violates the need-to-know principle and can compromise the investigation, alert an insider threat, or create legal liability.
Requiring the handler to work alone increases the risk of undetected errors and creates a single point of failure; isolation does not protect evidence integrity.
Limiting incident knowledge to only one person creates a dangerous single point of failure, eliminates peer oversight, and contradicts accountability best practices.
A second responder provides peer review of actions taken, reduces the chance of mistakes made under pressure, and supports proper documentation and chain-of-custody maintenance. This improves accuracy and accountability in the response process without compromising evidence integrity, making it a consistently recommended guideline when resources permit.
Concept tested: Incident response team collaboration and information handling guidelines
Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
Topics
Community Discussion
No community discussion yet for this question.