Study. uk . com
  1. Home
  2. All questions
  3. Question 495

CompTIA Security+ study material · question 495 of 611

Which incident response phase most determines how well the other three go?

  1. Preparation
  2. Post-incident activity
  3. Containment
  4. Detection and analysis
Show the answer

Answer: A. Preparation

Without contacts, tooling, baselines and authority agreed beforehand, everything after detection is improvised.

Source: NIST SP 800-61 Rev. 2 (NIST) — SP 800-61 Rev. 2 § 3.1 Preparation

Challenge yourself on this topic → Study as cards