nerdexam
GIAC

GCIH · Question #468

How can you minimize your chances of a mistake, such as not notifying a required party, being made during an incident response?

The correct answer is C. Have proper procedures in place. Documented procedures reduce human error during incident response by providing step-by-step guidance that ensures no required action or notification is overlooked.

Incident Response & Cyber Kill Chain

Question

How can you minimize your chances of a mistake, such as not notifying a required party, being made during an incident response?

Options

  • AHave management support
  • BHave administrative access to all systems
  • CHave proper procedures in place
  • DFill out chain of custody forms promptly

How the community answered

(22 responses)
  • A
    5% (1)
  • B
    5% (1)
  • C
    91% (20)

Why each option

Documented procedures reduce human error during incident response by providing step-by-step guidance that ensures no required action or notification is overlooked.

AHave management support

Management support is important culturally but does not directly prevent procedural mistakes like missing a required notification during an active incident.

BHave administrative access to all systems

Administrative access enables responders to act on systems but does not guide them on what steps to take or who to notify.

CHave proper procedures in placeCorrect

Proper procedures - such as incident response playbooks or runbooks - define every required action, notification, and escalation path in advance. This removes reliance on memory under stress, ensuring that required parties are always notified and steps are not skipped. Without documented procedures, even experienced responders can omit critical steps during high-pressure incidents.

DFill out chain of custody forms promptly

Chain of custody forms are relevant to evidence handling in forensic investigations, not to preventing notification or response mistakes during the broader incident.

Concept tested: Incident response procedures and documentation importance

Source: https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final

Topics

#incident procedures#incident handling#documentation#response preparation

Community Discussion

No community discussion yet for this question.

Full GCIH Practice