200-201 Question 336
Select 3Your organization is developing a cybersecurity incident response plan. As part of the preparation phase, you are tasked with ensuring that all employees are ready to respond effectively to potential security incidents. Which of the following activities should you prioritize during the preparation phase?
- A
Conduct regular employee training on security awareness and incident response procedures.
- B
Establish and regularly update an incident response playbook.
- C
Monitor real-time network traffic for potential security threats.
- D
Develop a communication plan that includes internal and external stakeholders.
- E
Perform a forensic investigation of past incidents to identify root causes.
Show answer and explanation
Correct answers: A, B, D
Explanation
The preparation phase focuses on proactive activities that ensure readiness for potential incidents. This includes training employees, creating and updating an incident response playbook, and developing a communication plan. These activities help establish a strong foundation for an effective incident response process. Monitoring traffic and forensic investigations are important but belong to other phases of the incident response lifecycle.
- A. Correct.
Conducting regular employee training is essential during the preparation phase to ensure that employees understand their roles and can effectively respond to incidents.
- B. Correct.
Establishing and updating an incident response playbook provides clear guidance on how to handle various security scenarios, which is a critical element of preparation.
- C. Incorrect.
Monitoring real-time network traffic is an activity associated with the detection phase, not the preparation phase.
- D. Correct.
Developing a communication plan is a key part of preparation to ensure that all stakeholders know how to communicate during an incident.
- E. Incorrect.
Performing forensic investigations is part of the post-incident analysis phase, not the preparation phase.