nerdexam
GIAC

GCIH · Question #778

What shortcoming of the traditional PICERL incident response model is addressed by adopting a dynamic incident response model like DAIR?

The correct answer is A. Linear approach imparts the success of response activities. The traditional PICERL model follows a strict linear sequence of phases, which limits responders from adapting to complex, evolving incidents that require revisiting earlier steps.

Incident Response & Cyber Kill Chain

Question

What shortcoming of the traditional PICERL incident response model is addressed by adopting a dynamic incident response model like DAIR?

Options

  • ALinear approach imparts the success of response activities
  • BInability to enforce written policies and procedures during an investigation
  • CNo differentiation between short and longterm containment tactics
  • DSteps are continually revisited in a loop with no clear endpoint

How the community answered

(61 responses)
  • A
    70% (43)
  • B
    3% (2)
  • C
    18% (11)
  • D
    8% (5)

Why each option

The traditional PICERL model follows a strict linear sequence of phases, which limits responders from adapting to complex, evolving incidents that require revisiting earlier steps.

ALinear approach imparts the success of response activitiesCorrect

PICERL (Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned) enforces a fixed sequential order, which impairs the ability of responders to act on new findings that require cycling back to earlier phases. DAIR addresses this by allowing flexible, iterative movement between response activities rather than forcing a rigid progression.

BInability to enforce written policies and procedures during an investigation

Neither PICERL nor DAIR inherently enforces written policies; both models rely on pre-established procedures, so this is not a distinguishing shortcoming of PICERL.

CNo differentiation between short and longterm containment tactics

PICERL does distinguish between short-term and long-term containment as recognized sub-phases within the Containment step, so this is not an accurate criticism.

DSteps are continually revisited in a loop with no clear endpoint

PICERL actually has a well-defined endpoint - the Lessons Learned phase - so it does not loop indefinitely; the criticism of PICERL is the opposite problem of being too rigid and linear.

Concept tested: PICERL vs DAIR incident response model limitations

Source: https://www.nist.gov/publications/computer-security-incident-handling-guide

Topics

#PICERL#DAIR#dynamic incident response#linear model limitation

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GCIH Practice