The incident response team has completed root cause analysis for an incident. Which of the following actions should be taken in the next phase of the incident response process? (Choose two.)
A. Providing a briefing to management: It's important to communicate the findings of the incident, the root cause, and the impact to management to ensure they are informed and can make strategic decisions.
B. Updating policies and procedures: After an incident, policies and procedures should be updated based on lessons learned during the incident. This helps prevent similar incidents in the future and improves overall security posture.
Here’s why the other options are less applicable:
C. While training is essential, it’s more of an ongoing task and not immediately necessary in the direct aftermath of a single incident.
D. This is generally only necessary if there was a clear case of negligence or malicious intent by employees, which isn't typically part of the standard post-incident actions.
E. This would have been done earlier, during the Recovery phase, and not after the root cause analysis.
upvoted 1 times
...
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
044f354
1 month, 3 weeks ago