nerdexam
GIAC

GSLC · Question #131

The Incident handling process implemented in an enterprise is responsible to deal with all the incidents regarding the enterprise. Which of the following procedures will be involved by the…

The correct answer is A. Building up an incident response kit. The preparation phase of incident handling focuses on proactive readiness before any incident occurs, which includes assembling the tools and resources needed to respond effectively.

Security Operations & Incident Response Leadership

Question

The Incident handling process implemented in an enterprise is responsible to deal with all the incidents regarding the enterprise. Which of the following procedures will be involved by the preparation phase of the Incident handling process?

Options

  • ABuilding up an incident response kit
  • BSetting up the initial position after an incident
  • CWorking with QA to validate security of the enterprise
  • DOrganizing a solution to remove an incident

How the community answered

(48 responses)
  • A
    92% (44)
  • B
    2% (1)
  • C
    2% (1)
  • D
    4% (2)

Why each option

The preparation phase of incident handling focuses on proactive readiness before any incident occurs, which includes assembling the tools and resources needed to respond effectively.

ABuilding up an incident response kitCorrect

According to NIST SP 800-61, the preparation phase involves establishing the incident response capability before incidents happen, which includes building an incident response kit - a collection of hardware, software, and documentation tools that responders will use during an actual incident to detect, analyze, and contain threats efficiently.

BSetting up the initial position after an incident

Restoring the system to its initial position after an incident is part of the recovery phase, not preparation.

CWorking with QA to validate security of the enterprise

Ongoing security validation with QA relates to continuous security assurance operations, not the specific pre-incident readiness activities of the preparation phase.

DOrganizing a solution to remove an incident

Organizing a solution to remove an incident describes the eradication phase, which occurs after containment has been achieved.

Concept tested: Incident response preparation phase activities

Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf

Topics

#incident handling#incident response#preparation phase#incident response kit

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GSLC Practice