SY0-701 Question 78

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A2

  IR phases (per NIST 800-61): 1. Preparation is the roles and responsibilities, 2. detection and analysis, 3. containment, eradication, and recovery, and 4. Post- Incident Activity (Lessons Learned). Keep in mind, Preparation, the organization and specifically analysts and incident responders defined as roles and responsibilities, communication plans, escalation paths, policies and procedures, tools, technologies, and readiness, & training and tabletop exercises.

• Chose A1

  During the preparation phase, the organization establishes clear roles and responsibilities for each team member involved in incident response, develops the incident response plan, gathers necessary tools and resources, and conducts training for employees on how to respond to incidents.

• Chose C2

  Preparation is proactive (assign roles) Lessons Learned is reflective (review roles)