200-201 Question 335
Select 3An organization is in the process of preparing for potential cybersecurity incidents. Which of the following actions should be prioritized during the preparation phase to ensure an effective incident response plan?
- A
Developing and regularly updating an incident response plan (IRP).
- B
Testing the incident response plan through tabletop exercises.
- C
Monitoring network traffic for suspicious activities in real-time.
- D
Establishing communication protocols for internal and external stakeholders during an incident.
- E
Deploying endpoint detection and response (EDR) tools across all systems.
Show answer and explanation
Correct answers: A, B, D
Explanation
The preparation phase focuses on creating, refining, and testing the policies, plans, and communication strategies that ensure an organization is ready to handle cybersecurity incidents effectively. Developing an incident response plan, conducting tabletop exercises, and defining communication protocols are essential steps within this phase. Detection mechanisms, such as monitoring traffic or deploying EDR tools, are critical but are part of other phases like detection or protection.
- A. Correct.
Developing and regularly updating an incident response plan is a critical part of the preparation phase to ensure all stakeholders know their roles and the steps to take during an incident.
- B. Correct.
Testing the incident response plan through tabletop exercises helps to identify gaps in the plan and ensures readiness for real-world scenarios.
- C. Incorrect.
Monitoring network traffic is a detection and analysis activity, which occurs during the detection phase, not the preparation phase.
- D. Correct.
Establishing communication protocols for both internal and external stakeholders ensures clear and effective communication during an incident, making it a key component of the preparation phase.
- E. Incorrect.
Deploying endpoint detection and response tools is part of the detection and protection mechanisms, which fall outside the scope of the preparation phase.