GCIH · Question #6
Which of the following are the primary goals of the incident handling team? Each correct answer represents a complete solution. Choose all that apply.
The correct answer is A. Freeze the scene. B. Repair any damage caused by an incident. C. Prevent any further damage. The primary goals of an incident handling team are operational - preserve evidence, contain damage, and restore systems - not administrative escalation. Informing higher authorities is a management communication task, not a core incident handling objective.
Question
Which of the following are the primary goals of the incident handling team? Each correct answer represents a complete solution. Choose all that apply.
Options
- AFreeze the scene.
- BRepair any damage caused by an incident.
- CPrevent any further damage.
- DInform higher authorities.
How the community answered
(58 responses)- A93% (54)
- D7% (4)
Why each option
The primary goals of an incident handling team are operational - preserve evidence, contain damage, and restore systems - not administrative escalation. Informing higher authorities is a management communication task, not a core incident handling objective.
Freezing the scene preserves forensic integrity by preventing evidence from being altered or destroyed, which is foundational to both understanding the incident and potential legal proceedings.
Repairing damage caused by the incident - restoring systems, files, and services to normal operation - is a direct responsibility of the incident handling team during the recovery phase.
Preventing further damage through containment actions (isolating systems, blocking traffic, revoking credentials) is a critical immediate objective to limit the incident's scope and impact.
Informing higher authorities is a management and communications responsibility handled by organizational leadership or a designated communications officer, not a primary technical goal of the incident handling team itself.
Concept tested: Incident response team primary objectives and scope
Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
Topics
Community Discussion
No community discussion yet for this question.