CISM Question 143

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A2

  A. a consolidated event timeline. A consolidated event timeline is primarily used during a post-incident review to analyze the sequence and correlation of actions. This timeline combines data from various sources to provide a comprehensive overview of the incident from start to finish. It helps to understand the chronological order of events, how the incident unfolded, and how responses were made at each stage. By laying out the sequence of events in a linear timeline, it's easier to identify any delays, overlaps, or gaps in the response, which are crucial for improving future incident response strategies. While logs from systems involved (option B), interviews with personnel (option C), and documents created during the incident (option D) are valuable sources of information, they contribute to the creation of the consolidated event timeline rather than serve as primary analytical tools by themselves. These elements feed into the timeline, providing details and context that help to form a complete picture of the incident and the effectiveness of the response.

• 2

  A - Key words - "Sequence"

• 1

  B,C,D are all used to create A