200-201 Question 348
Select 3Your organization is preparing for potential cybersecurity incidents by developing an incident response plan (IRP). Which of the following tasks should be prioritized during the preparation phase to ensure an effective incident response process?
- A
Defining roles and responsibilities for the incident response team
- B
Configuring automated alerts for potential security breaches
- C
Conducting regular tabletop exercises to simulate incidents
- D
Eradicating all malware from infected systems
- E
Establishing communication protocols for internal and external stakeholders
- F
Performing root cause analysis on past incidents
Show answer and explanation
Correct answers: A, C, E
Explanation
The preparation phase of incident response focuses on setting up the groundwork for a swift and effective response to cybersecurity incidents. Key tasks include defining team roles, testing the response plan through exercises, and establishing clear communication protocols. These steps ensure that the organization is prepared to handle incidents efficiently, minimizing potential damage and downtime.
- A. Correct.
Defining roles and responsibilities is a critical part of the preparation phase to ensure that team members understand their tasks during an incident. It helps streamline the response process.
- B. Incorrect.
While configuring automated alerts is important, it is more aligned with detection and monitoring rather than preparation. This task typically falls under the detection phase of the incident response lifecycle.
- C. Correct.
Conducting tabletop exercises helps test the incident response plan and ensures that the team is familiar with their roles. This is an essential activity during the preparation phase.
- D. Incorrect.
Eradicating malware is part of the containment, eradication, and recovery phases of the incident response lifecycle, not the preparation phase.
- E. Correct.
Establishing communication protocols is vital for effective coordination during an incident and is a key activity in the preparation phase.
- F. Incorrect.
Performing root cause analysis is typically done after an incident in the post-incident phase to improve the response process and prevent future occurrences.