Question

1. Which of the following principles describes how a security analyst should communicate during an incident?
A. The communication should be limited to trusted parties only.
B. The communication should be limited to security staff only.
C. The communication should come from law enforcement.
D. The communication should be limited to management only.

 

Answer 1

1. Which of the following principles describes how a security analyst should communicate during an incident?

Answer:

A. The communication should be limited to trusted parties only.

Explanation:

During a security breach it is best to limit communication to trusted parties because there parties could also be in charge of taking decisions thus communicating the issue to any other party could delay remedial measures. This is especially effective in the case of a large attack and where you'd want to eliminate any involvement of hostile parties.

Why the other options don't fit:
B. The communication should be limited to security staff only.

Explanation

Security staff could be involved for smaller threats but deciding on this based on the magnitude of the threat but often, it is better to limit communication to trusted parties.

C. The communication should come from law enforcement.

Explanation

In the case of a breach with results in litigation or legal proceedings, then after the authorities and related offices/departments are notified, the analyst could wait for communication from law enforcement.

D. The communication should be limited to management only.

Explanation

At times certain other departments could be stakeholders and thus limiting communication only to management would prove inefficient.