CompTIA CS0-003 Exam - Topic 8 Question 13 Discussion

Actual exam question for CompTIA's CS0-003 exam

Question #: 13
Topic #: 8

A security team conducts a lessons-learned meeting after struggling to determine who should conduct the next steps following a security event. Which of the following should the team create to address this issue?

AService-level agreement

BChange management plan

CIncident response plan

DMemorandum of understanding

Show Suggested Answer

Suggested Answer: C

An incident response plan (IRP) is a document that defines the roles and responsibilities, procedures, and guidelines for responding to a security incident. It helps the security team to act quickly and effectively, minimizing the impact and cost of the incident. An IRP should specify who should conduct the next steps following a security event, such as containment, eradication, recovery, and analysis12. Reference: CompTIA CySA+ CS0-003 Certification Study Guide, page 362; 6 Incident Response Steps to Take After a Security Event, section 2.

by Fatima at Feb 13, 2024, 12:43 AM

Limited Time Offer

25%

Off

Get Premium CS0-003 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Na

3 months ago

Surprised no one mentioned the importance of clear roles!

upvoted 0 times

...

Reyes

3 months ago

Wait, why would a memorandum of understanding be relevant?

upvoted 0 times

...

Billy

3 months ago

A service-level agreement? Not sure that fits here.

upvoted 0 times

...

Elke

4 months ago

I think a change management plan could help too.

upvoted 0 times

...

Carmela

4 months ago

Definitely need an incident response plan for this.

upvoted 0 times

...

Verda

4 months ago

A change management plan seems off-topic here, but I can't recall if it ever overlaps with incident response procedures.

upvoted 0 times

...

Zoila

4 months ago

I feel like we practiced a similar question, and the incident response plan was emphasized as crucial for guiding next steps.

upvoted 0 times

...

Bernadine

4 months ago

I'm not entirely sure, but I remember something about service-level agreements being more about expectations rather than specific actions after an incident.

upvoted 0 times

...

Geoffrey

5 months ago

I think the incident response plan might be the right choice since it outlines the steps to take after a security event.

upvoted 0 times

...

Joesph

5 months ago

The memorandum of understanding seems like it could be a good fit, as it would help establish the expectations and responsibilities of the team. I'll make sure to consider that option.

upvoted 0 times

...

Jean

5 months ago

A service-level agreement could work, but I'm not sure if that's the most appropriate solution for this specific issue. I'll have to review the details again.

upvoted 0 times

...

Cletus

5 months ago

I'm a bit unsure on this one. Is a change management plan the right approach? I'll need to think it through more carefully.

upvoted 0 times

...

Maia

5 months ago

I think the incident response plan is the best option here. It should clearly outline the roles and responsibilities of the security team during a security event.

upvoted 0 times

...

Evangelina

5 months ago

I'm not entirely sure about the timing differences between the two. I'll need to double-check whether rollups are processed at midnight or if they have standard latency like global report suites.

upvoted 0 times

...

Yoko

5 months ago

This seems like a straightforward IGMP question. I'll review what I know about IGMP Host Membership Queries and try to eliminate the incorrect options.

upvoted 0 times

...

Rebbecca

2 years ago

I think having a clear Incident response plan would prevent confusion and ensure a timely response.

upvoted 0 times

...

Herminia

2 years ago

That's true, but an Incident response plan specifically addresses how to handle security events.

upvoted 0 times

...

Brandon

2 years ago

But wouldn't a Service-level agreement also help define roles and responsibilities?

upvoted 0 times

...

Rebbecca

2 years ago

I agree with Herminia, an Incident response plan would provide clear guidance on next steps.

upvoted 0 times

...

Herminia

2 years ago

I think the team should create an Incident response plan.

upvoted 0 times

...

Marica

2 years ago

Hmm, I'm not so sure about that. Wouldn't a service-level agreement be more appropriate? That way they can define the expected response times and escalation procedures. Might be easier than a full-blown incident response plan.

upvoted 0 times

...

An

2 years ago

I don't know, the change management plan could also be helpful. If they're struggling to determine who should do what, maybe they need to review their processes and protocols. Tighten things up, you know?

upvoted 0 times

...

Ines

2 years ago

Yeah, I agree. The incident response plan is probably the best option. It needs to be comprehensive and cover all the bases, so everyone knows their part if something like this happens again.

upvoted 0 times

Jenise

2 years ago

Yes, communication and coordination are key in these situations

upvoted 0 times

...

Laurena

2 years ago

We should make sure everyone is familiar with the plan

upvoted 0 times

...

Charlena

2 years ago

Agreed, we need to be prepared for any future incidents

upvoted 0 times

...

Lavonda

2 years ago

Definitely, it's important to have a plan in place

upvoted 0 times

...

Justine

2 years ago

I think that's the best choice

upvoted 0 times

...

Samira

2 years ago

Incident response plan

upvoted 0 times

...

Adelle

2 years ago

Whew, that's a tough one. Sounds like they really dropped the ball on that security event. I'm guessing the incident response plan would be the way to go here - it should clearly outline the roles and responsibilities for everyone involved.

upvoted 0 times

...