Study. uk . com
  1. Home
  2. All questions
  3. Question 596

CompTIA Security+ study material · question 596 of 611

Why does NIST advise building detection and analysis capability across the organisation rather than only in the security team?

  1. Because it reduces the cost of the security team
  2. Because an incident nobody notices proceeds unopposed
  3. Because regulators require distributed monitoring
  4. Because the security team lacks the necessary tooling
Show the answer

Answer: B. Because an incident nobody notices proceeds unopposed

Most incidents are first noticed by someone outside the security team, so their ability to recognise and report matters.

Source: NIST SP 800-61 Rev. 2 (NIST) — SP 800-61 Rev. 2 § 1 Introduction

Challenge yourself on this topic → Study as cards