Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified Information Security Manager · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
B. A Post Incident review can point out the Gap of not having an SIEM solution.
Pretty sure this is D. Trying to identify would have been easier with a SIEM solution to correlate all the event and incident data.
I am changing to B, sorry. It states this is the first time they encountered this incident. Then it asks how to identify similar incidents later. If all we care about is identifying similar incidents to an incident they had never occurred before it would be post-incident review. This way they can gain knowledge and understand what to identify for this particular incident and identify/navigate similar ones in the future.