Practice Question · CISSP Study Group

Practice Question

Your Security Information and Event Management (SIEM) system has generated numerous alerts indicating suspicious network activity. You need to determine the severity and scope of the potential incident. Which of the following actions should you take FIRST?

a) Immediately block all network traffic to prevent any further damage.

b) Conduct an incident response triage to analyze the alerts, correlate events, and determine the potential impact.

c) Notify law enforcement and regulatory authorities about the potential incident.

d) Begin restoring systems from backups to minimize downtime.

8 comments