GSLC · Question #458
You are an Incident manager in Orangesect.Inc. You have been tasked to set up a new extension of your enterprise. The networking, to be done in the new extension, requires different types of cables…
The correct answer is D. Preparation. The Preparation phase of incident handling is where an organization makes proactive decisions about infrastructure, policies, and tools before any incident occurs.
Question
You are an Incident manager in Orangesect.Inc. You have been tasked to set up a new extension of your enterprise. The networking, to be done in the new extension, requires different types of cables and an appropriate policy that will be decided by you. Which of the following stages in the Incident handling process involves your decision making?
Options
- AContainment
- BEradication
- CIdentification
- DPreparation
How the community answered
(31 responses)- A3% (1)
- C3% (1)
- D94% (29)
Why each option
The Preparation phase of incident handling is where an organization makes proactive decisions about infrastructure, policies, and tools before any incident occurs.
Containment is the phase where the spread or impact of an active incident is limited, not where pre-deployment infrastructure planning decisions are made.
Eradication involves removing the root cause or malicious artifacts of an incident that has already occurred, not pre-deployment planning.
Identification is the phase where an incident is detected and confirmed, not where network design or policy decisions are made.
Preparation is the first phase of the incident handling process, during which organizations establish policies, acquire tools, and set up infrastructure such as cabling and networking. Deciding which cables to use and defining network policy for a new extension are preparatory activities performed before any incident takes place, making this the correct phase.
Concept tested: Incident handling preparation phase scope
Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
Topics
Community Discussion
No community discussion yet for this question.