Principles of Incident Response And Disaster Recovery By Michael E. Whitman 2nd Edition – Test Bank

Principles of Incident Response And Disaster Recovery By Michael E. Whitman 2nd Edition – Test Bank

.

Chapter 6: Incident Response: Organizing and Preparing the CSIRT

TRUE/FALSE

1. The CSIRT is also known as the IR Reaction Team.

ANS: T PTS: 1 REF: 241

2. The involvement of the CSIRT in incident response typically starts with prevention.

ANS: F PTS: 1 REF: 241

3. As soon as the CSIRT is able to determine what exactly is happening, it is expected to report its preliminary finding to management.

ANS: T PTS: 1 REF: 247

4. Regardless of which IR model an organization chooses, multiple employees should be in charge of incident response.

ANS: F PTS: 1 REF: 255

5. One of the first signals that an organization is making progress in the development of its IR program, specifically in the development of its CSIRT, is a dramatic drop in the number of identified incidents.

ANS: F PTS: 1 REF: 260