nerdexam
GIAC

GSLC · Question #458

You are an Incident manager in Orangesect.Inc. You have been tasked to set up a new extension of your enterprise. The networking, to be done in the new extension, requires different types of cables…

The correct answer is D. Preparation. The Preparation phase of incident handling is where an organization makes proactive decisions about infrastructure, policies, and tools before any incident occurs.

Security Operations & Incident Response Leadership

Question

You are an Incident manager in Orangesect.Inc. You have been tasked to set up a new extension of your enterprise. The networking, to be done in the new extension, requires different types of cables and an appropriate policy that will be decided by you. Which of the following stages in the Incident handling process involves your decision making?

Options

  • AContainment
  • BEradication
  • CIdentification
  • DPreparation

How the community answered

(31 responses)
  • A
    3% (1)
  • C
    3% (1)
  • D
    94% (29)

Why each option

The Preparation phase of incident handling is where an organization makes proactive decisions about infrastructure, policies, and tools before any incident occurs.

AContainment

Containment is the phase where the spread or impact of an active incident is limited, not where pre-deployment infrastructure planning decisions are made.

BEradication

Eradication involves removing the root cause or malicious artifacts of an incident that has already occurred, not pre-deployment planning.

CIdentification

Identification is the phase where an incident is detected and confirmed, not where network design or policy decisions are made.

DPreparationCorrect

Preparation is the first phase of the incident handling process, during which organizations establish policies, acquire tools, and set up infrastructure such as cabling and networking. Deciding which cables to use and defining network policy for a new extension are preparatory activities performed before any incident takes place, making this the correct phase.

Concept tested: Incident handling preparation phase scope

Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf

Topics

#incident handling#preparation phase#incident management#network policy

Community Discussion

No community discussion yet for this question.

Full GSLC Practice