nerdexam
GIAC

GCIH · Question #497

A Linux server which is in the scope of an Incident Response you are performing has been rebuilt and tested by the accounting department. The accounting department is the business owner of the…

The correct answer is A. Bring the system back into operation now because that is the request of the business owner and. The decision of when to put the system back into business has to be made by the system owner. As a handler you can give them advice and try to be helpful, but this is their call. They are the ones that depend on this system. Document your advice in a signed memo to the system…

Incident Response & Cyber Kill Chain

Question

A Linux server which is in the scope of an Incident Response you are performing has been rebuilt and tested by the accounting department. The accounting department is the business owner of the server, and you have recommended that the server should be put back into production at 9pm this evening. The accounting department tells you that the system needs to be back in operation now. What do you do?

Options

  • ABring the system back into operation now because that is the request of the business owner and
  • BBring the system back into operation at 5:30pm because that is a fair compromise and document
  • CBring the system back into operation at 9pm because that's what you as Incident Handler have
  • DBring the system into operation at 9pm because it will be easier to monitor at that time and

How the community answered

(25 responses)
  • A
    76% (19)
  • B
    12% (3)
  • C
    4% (1)
  • D
    8% (2)

Explanation

The decision of when to put the system back into business has to be made by the system owner. As a handler you can give them advice and try to be helpful, but this is their call. They are the ones that depend on this system. Document your advice in a signed memo to the system owner. Remember, you may not get your way in this decision, but at least you've documented your recommendations.

Topics

#IR governance#business owner authority#incident decision-making#documentation

Community Discussion

No community discussion yet for this question.

Full GCIH Practice