nerdexam
Palo_Alto_Networks

PCCET · Question #238

The seventy of an attack needs to be escalated. What needs to be in place in order for the security operations team to properly inform various units within the enterprise of the issue?

The correct answer is A. Interface Agreement. To effectively inform various enterprise units about an escalated attack, the security operations team requires a formal, pre-established agreement outlining communication protocols and responsibilities.

Submitted by deeparc· Apr 18, 2026Security Operations (SOC)

Question

The seventy of an attack needs to be escalated. What needs to be in place in order for the security operations team to properly inform various units within the enterprise of the issue?

Options

  • AInterface Agreement
  • BFAO Incident Site
  • CCorporate Executive Listserv
  • DSecurity Breach Blog

How the community answered

(39 responses)
  • A
    90% (35)
  • B
    3% (1)
  • C
    3% (1)
  • D
    5% (2)

Why each option

To effectively inform various enterprise units about an escalated attack, the security operations team requires a formal, pre-established agreement outlining communication protocols and responsibilities.

AInterface AgreementCorrect

An Interface Agreement (or a similar formal document within an Incident Response Plan) defines the established communication channels, protocols, and responsibilities for informing various units within an enterprise during security incidents, ensuring proper and timely information dissemination and coordination.

BFAO Incident Site

An 'FAO Incident Site' is irrelevant; the Food and Agriculture Organization (FAO) is an international body, and an 'Incident Site' alone does not describe a communication mechanism for informing various units.

CCorporate Executive Listserv

A 'Corporate Executive Listserv' is an informal and limited communication channel that primarily targets executives and does not constitute a proper, enterprise-wide mechanism for informing diverse units about their specific roles in an incident.

DSecurity Breach Blog

A 'Security Breach Blog' is an informational tool, not a formal, real-time communication protocol for structured incident escalation and coordinated response across multiple internal enterprise units.

Concept tested: Incident response communication and escalation protocols

Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf

Topics

#Incident Response#Inter-departmental Communication#Operational Agreements#Escalation Procedures

Community Discussion

No community discussion yet for this question.

Full PCCET Practice