CompTIA Exam CS0-003 Topic 8 Question 13 Discussion

Actual exam question for CompTIA's CS0-003 exam

Question #: 13
Topic #: 8

A security team conducts a lessons-learned meeting after struggling to determine who should conduct the next steps following a security event. Which of the following should the team create to address this issue?

AService-level agreement

BChange management plan

CIncident response plan

DMemorandum of understanding

Show Suggested Answer

Suggested Answer: C

An incident response plan (IRP) is a document that defines the roles and responsibilities, procedures, and guidelines for responding to a security incident. It helps the security team to act quickly and effectively, minimizing the impact and cost of the incident. An IRP should specify who should conduct the next steps following a security event, such as containment, eradication, recovery, and analysis12. Reference: CompTIA CySA+ CS0-003 Certification Study Guide, page 362; 6 Incident Response Steps to Take After a Security Event, section 2.

by Fatima at Feb 13, 2024, 12:43 AM

Limited Time Offer

25%

Off

Get Premium CS0-003 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Rebbecca

6 months ago

I think having a clear Incident response plan would prevent confusion and ensure a timely response.

upvoted 0 times

...

Herminia

7 months ago

That's true, but an Incident response plan specifically addresses how to handle security events.

upvoted 0 times

...

Brandon

7 months ago

But wouldn't a Service-level agreement also help define roles and responsibilities?

upvoted 0 times

...

Rebbecca

7 months ago

I agree with Herminia, an Incident response plan would provide clear guidance on next steps.

upvoted 0 times

...

Herminia

7 months ago

I think the team should create an Incident response plan.

upvoted 0 times

...

Marica

8 months ago

Hmm, I'm not so sure about that. Wouldn't a service-level agreement be more appropriate? That way they can define the expected response times and escalation procedures. Might be easier than a full-blown incident response plan.

upvoted 0 times

...

An

8 months ago

I don't know, the change management plan could also be helpful. If they're struggling to determine who should do what, maybe they need to review their processes and protocols. Tighten things up, you know?

upvoted 0 times

...

Ines

8 months ago

Yeah, I agree. The incident response plan is probably the best option. It needs to be comprehensive and cover all the bases, so everyone knows their part if something like this happens again.

upvoted 0 times

Jenise

7 months ago

Yes, communication and coordination are key in these situations

upvoted 0 times

...

Laurena

8 months ago

We should make sure everyone is familiar with the plan

upvoted 0 times

...

Charlena

8 months ago

Agreed, we need to be prepared for any future incidents

upvoted 0 times

...

Lavonda

8 months ago

Definitely, it's important to have a plan in place

upvoted 0 times

...

Justine

8 months ago

I think that's the best choice

upvoted 0 times

...

Samira

8 months ago

Incident response plan

upvoted 0 times

...

Adelle

8 months ago

Whew, that's a tough one. Sounds like they really dropped the ball on that security event. I'm guessing the incident response plan would be the way to go here - it should clearly outline the roles and responsibilities for everyone involved.

upvoted 0 times

...