MENU
An incident response team is recommending changes after analyzing a recent compromise in which:
a large number of events and logs were involved;
team members were not able to identify the anomalous behavior and escalate it in a timely manner;
several network systems were affected as a result of the latency in detection;
security engineers were able to mitigate the threat and bring systems back to a stable state; and
the issue reoccurred shortly after and systems became unstable again because the correct information was not gathered during the initial identification phase.
Which two recommendations should be made for improving the incident response process? (Choose two.)
Suggested Answer: C, E
Get Premium 300-215 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
34 comments · newest first
BE
Bette
11 months ago
Modifying the playbook is crucial for better alignment!
CA
Catarina
11 months ago
Allocating more resources sounds good, but will it really help?
BA
Basilia
11 months ago
Wait, how did they miss the anomalous behavior in the first place?
NA
Nada
11 months ago
I think formalizing reporting is a must too.
NE
Nell
12 months ago
Definitely need to implement automated logs collection!
GE
Gerald
12 months ago
Allocating more resources for containment sounds reasonable, but I wonder if modifying the playbook might be more effective in preventing confusion during incidents.
JA
Jaclyn
1 year ago
I feel like implementing automated operations for logs could really help with context. We had a similar practice question about streamlining data collection.
KR
Kristeen
1 year ago
I'm not entirely sure, but I think improving the mitigation phase could help. We practiced scenarios where quick identification of causes was crucial.
TO
Tonette
1 year ago
I remember discussing the importance of formalizing reporting requirements in our last class. It seems like a good way to keep everyone informed during an incident.
IS
Isadora
1 year ago
I'm a bit confused by all the details in the scenario, but I think the recommendations around improving the mitigation phase and allocating more resources for the containment phase could be good options to consider. I'll need to re-read the question carefully to make sure I'm on the right track.
HI
Hildred
1 year ago
Okay, I think I've got it. Implementing an automated system to pull system events and logs seems like a key recommendation to address the issue with not being able to identify the anomalous behavior in a timely manner. And modifying the incident handling playbook to ensure alignment on roles and responsibilities before an incident occurs would also be really important.
KE
Kelvin
1 year ago
This question seems to be focused on improving the incident response process, so I'll need to carefully consider the recommendations that address the issues mentioned in the scenario.
AR
Arletta
1 year ago
Hmm, this is a tricky one. I'm not entirely sure which two recommendations would be the best, but I think formalizing reporting requirements and responsibilities could be a good start to improve communication during the incident.
TO
Torie
2 years ago
Haha, I bet the security team wishes they had a 'Hack Undo' button for when things go wrong. Too bad that's not an actual option on the exam.
AZ
Azzie
2 years ago
D) Allocate additional resources for the containment phase to stabilize systems in a timely manner and reduce an attack's breadth.
LE
Leatha
2 years ago
C) Implement an automated operation to pull systems events/logs and bring them into an organizational context.
MA
Maryann
2 years ago
B) Improve the mitigation phase to ensure causes can be quickly identified, and systems returned to a functioning state.
CA
Camellia
2 years ago
A) Formalize reporting requirements and responsibilities to update management and internal stakeholders throughout the incident-handling process effectively.
AN
Andra
2 years ago
I'd also consider B. Improving the mitigation phase to quickly identify and resolve the root cause is important to prevent the recurrence mentioned in the question.
CE
Cecilia
2 years ago
Allocating additional resources for the containment phase could help stabilize systems faster and reduce the impact of attacks.
JE
Jeanice
2 years ago
Yes, that's a good idea. We also need to improve the mitigation phase to quickly identify and resolve the root cause.
AL
Alyce
2 years ago
I think we should formalize reporting requirements and responsibilities to keep everyone updated.
SA
Sabine
2 years ago
I believe implementing an automated operation to pull system events/logs would be beneficial as well.
MI
Mila
2 years ago
I agree, C and E are the way to go. You can't rely on manual processes when you need to act fast during a breach. Automation is crucial.
ES
Esteban
2 years ago
Absolutely, manual processes can slow down response time. Automation and clear guidelines are key in incident response.
CA
Camellia
2 years ago
I agree with you. Automation can definitely speed up the process and having a clear playbook is essential.
HY
Hyun
2 years ago
E) Modify the incident handling playbook and checklist to ensure alignment and agreement on roles, responsibilities, and steps before an incident occurs.
VA
Van
2 years ago
C) Implement an automated operation to pull systems events/logs and bring them into an organizational context.
NI
Nickolas
2 years ago
Definitely go with C and E. Automating the log gathering process and updating the incident response playbook are key to avoiding the delays described in the scenario.
VI
Vincent
2 years ago
That sounds like a solid plan. Automating the log gathering process will definitely help speed up the response time.
AL
Aleisha
2 years ago
E) Modify the incident handling playbook and checklist to ensure alignment and agreement on roles, responsibilities, and steps before an incident occurs.
LA
Lavina
2 years ago
C) Implement an automated operation to pull systems events/logs and bring them into an organizational context.
KA
Kasandra
2 years ago
I agree with that. We also need to improve the mitigation phase for quick identification.
LE
Lezlie
2 years ago
I think we should formalize reporting requirements to keep everyone updated.