QuestionQ22
Incident Response ProcessesA security team is reviewing lessons learned and proposing process changes after a security-breach incident. During the incident, security-team members did not report abnormal system activity because of a heavy project workload. In addition, once the incident was identified, the response required six hours because management was unavailable to provide the necessary approvals. Which two actions will prevent these problems from occurring in the future?
Choose two
- A Introduce a priority rating for incident response workloads.
- B Provide phishing awareness training for the fill security team.
- C Conduct a risk audit of the incident response workflow.
- D Create an executive team delegation plan.
- E Automate security alert timeframes with escalation triggers.
Community Discussion