Exam CIS-SIR topic 1 question 52 discussion

The sn_si.external role is designed for external users or teams allowing them to view and work on assigned security incident tasks without granting broader access. Since David is a part of the Network team, this role gives him the ability to do his job without giving him broader access roles that Security Analyst and Basic allows. The read role allows David to view the task but not actively work the task. This is a tricky question but C is the best answer.

I think it should be B, because: - not only view but work on the task ( so I think update to) so External and READ are excluded - Security Analyst contains Security Basic and since Security Basic can also update it should be a minimum role that should be granted - External. We don't know if the question is about snc_external or sn_si.external

External Role for external users to view and work tasks assigned to them

Believe "C - External" is correct.

Since a response task may need additional investigation on incident or create change req or dig deep. With out additional precision on the type of task I’d go with option A.

Explanation: ebook p42, Security Analyst [sn_si.analyst] can - create and update security incidents, requetss tasks - create and update problems, changes and outages related to their incident