SSCP · Question #923
SSCP Question #923: Real Exam Question with Answer & Explanation
The correct answer is D: Within the first week of completing the investigation of the intrusion.. A post-mortem review meeting should be held with all involved parties within three to five working days of completing the investigation of the intrusion. Otherwise, participants are likely to forget critical information. Even if it enabled an organization to validate the correctn
Question
When should a post-mortem review meeting be held after an intrusion has been properly taken care of?
Options
- AWithin the first three months after the investigation of the intrusion is completed.
- BWithin the first week after prosecution of intruders have taken place, whether successful or
- CWithin the first month after the investigation of the intrusion is completed.
- DWithin the first week of completing the investigation of the intrusion.
Explanation
A post-mortem review meeting should be held with all involved parties within three to five working days of completing the investigation of the intrusion. Otherwise, participants are likely to forget critical information. Even if it enabled an organization to validate the correctness of its chain of custody of evidence, it would not make sense to wait until prosecution is complete because it would take too much time and many cases of intrusion never get to court anyway.
Topics
Community Discussion
No community discussion yet for this question.