The MAIN consideration when designing an incident escalation plan should be ensuring that:

A. appropriate stakeholders are involved
B. information assets are classified
C. requirements cover forensic analysis
D. high-impact risks have been identified

Which of the following is the PRIMARY objective of an incident communication plan?

A. To convey information about the incident to those affected by it
B. To prevent reputational damage to the organization
C. To prevent unannounced visits from the media during crisis
D. To fulfill regulatory requirements for incident response

When developing a classification method for incidents, the categories MUST be:

A. quantitatively defined.
B. regularly reviewed.
C. specific to situations.
D. assigned to incident handlers.

What is the MOST important factor for determining prioritization of incident response?

A. Service level agreements (SLAs) pertaining to the impacted systems
B. The potential impact to the business
C. The time to restore the impacted systems
D. The availability of specialized technical staff

Which of the following provides the MOST relevant evidence of incident response maturity?

A. Red team testing results
B. Average incident closure time
C. Independent audit assessment
D. Tabletop exercise results

The decision to escalate an incident should be based PRIMARILY on:

A. organizational hierarchy.
B. prioritization by the information security manager.
C. predefined policies and procedures.
D. response team experience.

A global organization is developing an incident response team (IRT). The organization wants to keep headquarters informed of all incidents and wants to be able to present a unified response to widely dispersed events. Which of the following IRT models BEST supports these objectives?

A. Holistic IRT
B. Central IRT
C. Coordinating IRT
D. Distributed IRT

During an emergency security incident, which of the following would MOST likely predict the worst-case scenario?

A. Cost-benefit analysis report
B. Business impact analysis (BIA) report
C. Risk assessment report
D. Vulnerability assessment report

Which of the following metrics is MOST useful to demonstrate the effectiveness of an incident response plan?

A. Average time to resolve an incident
B. Total number of reported incidents
C. Total number of incident responses
D. Average time to respond to an incident

Establishing which of the following is the BEST way of ensuring that the emergence of new risk is promptly identified?

A. Regular risk reporting
B. Risk monitoring processes
C. Change control procedures
D. Incident monitoring activities