Incident Response Reporting CS0-003 Practice Questions (Page 7)

Questions 31–32

1. 31application · medium

   A security manager wants to track the effectiveness of the incident response team's containment efforts. Which KPI is MOST appropriate for this purpose?

   • ATotal cost of the incident response team.
   • BPercentage of employees who completed security training.
   • CMean time to contain (MTTC).
   • DNumber of incidents reported per month.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   When should the lessons learned process be conducted after an incident?

   • ADuring the containment phase, to adjust strategies in real time.
   • BOnly if the incident resulted in significant financial loss.
   • CAfter the incident has been contained, eradicated, and services have been restored.
   • DImmediately upon detection, before any response actions are taken.
   Reveal Solution Discussion Select an answer first