Study. uk . com
  1. Home
  2. All questions
  3. Question 63

CISSP study material · question 63 of 500

A security operations centre receives forty incident tickets during one shift, and a new analyst begins working them in the order they arrived. The incident manager wants a defensible handling order the organisation can justify to auditors. Which basis should determine which incident is worked first?

  1. Work first on the incidents whose containment can realistically be finished before the shift ends
  2. Work the queue in arrival order so that the oldest reported incident is always the next one closed
  3. Rank each incident by asset criticality, functional and data impact, and how far the intrusion has progressed
  4. Rank the incidents by the severity rating the detection platform assigned to each triggering alert
Show the answer

Answer: C. Rank each incident by asset criticality, functional and data impact, and how far the intrusion has progressed

Triage ranks incidents on risk factors: asset criticality, functional and data impact, attacker progress, recoverability. First-come-first-served ignores risk, and tool severity ratings alone miss business impact.

Source: NIST SP 800-61 Rev. 3 (NIST) — SP 800-61r3 > Section 3.2, RS.MA and RS.MA-04

Challenge yourself on this topic → Study as cards