When compiling an incident response report, which of the following collections of elements is considered essential for detailing the fundamental aspects of the event?
The names of the SOC analysts on duty, the ticketing system used, and the mean time to respond (MTTR).
The legal counsel's opinion, the public relations statement, and the budget for cybersecurity awareness training.
The personnel involved, the nature of the event, the timeline and location, and the root cause of the incident.
The specific malware signature, the IDS/IPS alert logs, and the firewall rule that blocked the attacker's IP.
The correct answer includes the core components of an incident response report, which align with the 'five Ws' framework: Who, What, When, Where, and Why. A comprehensive report must detail the personnel involved (Who), the nature of the incident (What), the time and location (When and Where), and the root cause (Why). The other options list supporting details or related activities, but not the essential summary of the incident itself. Technical data like malware signatures and logs are evidence, not the summary. Operational details like analyst names are for internal tracking. Legal and PR communications are outcomes of the report, not its core content.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is the 'five Ws' framework in incident response?
Open an interactive chat with Bash
Why are technical details like malware signatures considered evidence rather than part of the incident summary?
Open an interactive chat with Bash
Why aren't operational or legal details the core focus of an incident response report?