350-201 Question 35
Select 3A company’s security team is evaluating their incident response process using key metrics. They identify that the Mean Time to Detect (MTTD) for incidents is higher than expected, and the Mean Time to Contain (MTTC) is resulting in prolonged exposure to threats. Which of the following actions would most effectively improve these metrics?
- A
Implement automated threat detection tools to reduce manual effort
- B
Conduct regular incident response drills to improve team coordination
- C
Increase the frequency of vulnerability scanning across the network
- D
Hire additional security analysts to monitor alerts around the clock
- E
Integrate threat intelligence feeds with SIEM for quicker incident identification
Show answer and explanation
Correct answers: A, B, E
Explanation
To improve incident response metrics such as Mean Time to Detect (MTTD) and Mean Time to Contain (MTTC), organizations should focus on automation, team preparedness, and integration of intelligence-driven tools. Options 1, 2, and 5 address these areas effectively by reducing detection time, improving coordination, and leveraging real-time data for quicker response. Options 3 and 4, while valuable for overall security, do not directly target the immediate improvement of these metrics.
- A. Correct.
Implementing automated threat detection tools can significantly reduce the Mean Time to Detect (MTTD) by expediting the identification of suspicious activities and reducing reliance on manual processes.
- B. Correct.
Regular incident response drills enhance the team's readiness and coordination, which can improve both Mean Time to Detect (MTTD) and Mean Time to Contain (MTTC) by ensuring effective and timely response actions.
- C. Incorrect.
While increasing the frequency of vulnerability scanning is beneficial for proactive threat management, it is not directly tied to reducing MTTD or MTTC during active incidents.
- D. Incorrect.
Hiring additional security analysts can help monitor alerts better, but without improving processes or tools, this may not directly lead to significant reductions in MTTD or MTTC.
- E. Correct.
Integrating threat intelligence feeds with a SIEM system enables faster and more accurate identification of threats, directly improving the Mean Time to Detect (MTTD).