Which of the following is true regarding the incident response process?

Which of the following is true regarding the incident response process?
A . It is a reactive process that is only initiated after an incident has occurred.
B . It is a proactive process that focuses on preventing incidents from occurring.
C . It is an iterative process that involves continuous improvement based on lessons learned.
D . It is a one-time process that is only performed when an organization first establishes its security program.

View Answer

Answer: C

Explanation:

Option 1: Incorrect. The incident response process can be both proactive and reactive. While it does involve reacting to incidents that have already occurred, it also includes proactive measures to prevent incidents from happening again in the future.

Option 2: Incorrect. While incident response can involve proactive measures to prevent incidents, it is not solely focused on prevention. It also includes reacting to incidents that have already occurred.

Option 3: Correct. The incident response process is an iterative process that involves continuous improvement based on lessons learned. Organizations should regularly review and update their incident response plans to ensure they are effective and up to date.

Option 4: Incorrect. The incident response process is not a one-time process. It should be an ongoing and continuous process to address security incidents as they occur and to improve the incident response

capabilities of the organization.