CISSP Practice Question (Domain 7: Security Operations / Incident Management & Governance)

During a multi-day incident response, the SOC lead wants to share detailed forensic findings in real time with executives and affected business units. Legal advises limiting distribution to avoid discoverability risk, while executives want transparency to make decisions.

What is the MOST appropriate action for the incident commander to take FIRST?

A. Distribute full forensic findings to ensure informed executive decisions

B. Establish an executive level incident briefing with sanitized summaries

C. Defer communication until the investigation is fully complete

D. Allow legal to control all incident communications

Come back for the answer tomorrow, or study more now!

22 comments