Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
CompTIA CySA+ Cybersecurity Analyst · CompTIA
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Respond = Start fighting the fire Remediate = Fire is fully out and damage repaired
The CEO is worried that the organization will not be fully patched by the time the 45 days has begun in which is when the patch will be available to the public, so once the patch is released, after 45 days hackers start checking which organizations are not patched yet, therefore decreasing the remediation time to 30 days gives the organization 15 days of leah way to thoroughly check if the organization will be / is fully patched.
Why not C (Mean Time to Respond of 15 days)? Mean Time to Respond (MTTR) refers to how quickly an organization reacts after detecting an incident. However, in this scenario, the goal is to prevent exploitation before attackers start using newly discovered vulnerabilities (~45 days after a patch is released). Even if the organization responds quickly (within 15 days of detecting an attack), it still means the attack already happened—which is not ideal.