Exam CS0-002 topic 1 question 327 discussion

I think the communication plan is to put it on work throughout the entire incident response process and not only for the recovery phase. If you follow the communication plan since an incident has been confirmed you can avoid a potential unwanted information leak to the public that might cause a reputation damage for the company. Going with A here and also because is the most convenient for the organization.

The correct answer is A. They can help to prevent the inadvertent release of damaging information outside the organization. Having communication plans in place in response to different cybersecurity incident triggers can help prevent the inadvertent release of damaging information outside the organization. When a cybersecurity incident occurs, it is important to have a clear and coordinated approach to communication within the organization. This ensures that accurate and controlled information is shared with the appropriate stakeholders, minimizing the risk of sensitive information being leaked or released to unauthorized individuals or the public.

Although other choices also make sense, the best "GENERIC" approach would be A as it says "in response to different cybersecurity incident triggers". B is for worms C is for specific breach that has taken place D is for "vulnerability" as per patching

A is the only answer that makes sense. B does nothing, C - no requirement to inform media at that time and D - Senior management don't need to know about patching updates.