Exam CAS-004 topic 1 question 306 discussion

B. "implement user awareness training" is part of the preparation incident response process from the casp mark birch book

B. Preparation The "Preparation" phase typically encompasses developing and maintaining incident response policies, procedures, and protocols, training staff to recognize and report incidents, and ensuring that resources are in place to effectively respond to incidents

o Preparation: The long delay in reporting the missing device indicates a lack of awareness or preparedness within the organization regarding security procedures. If the employee had been informed about the proper reporting timeframes for missing devices, the incident could have been detected and contained much earlier. This points to a failure in the preparation phase, which involves establishing policies, procedures, and training related to incident response, including device security and reporting guidelines. o A. Containment: Containment focuses on limiting the spread of an incident. While the delayed reporting certainly impacted the ability to contain the potential damage, the issue itself is rooted in the lack of preparation, not the containment efforts (assuming containment actions were taken once the incident was reported).

There's no indication as to whether or not the company was prepared, but with an appropriate containment strategy the device would have flagged itself as offline or been noticed missing before the employee reported it. The fact that no one knew the device was missing until the employee asked for a new one shows that lost/stolen devices do not have an appropriate containment strategy.

It's B - the company was not PREPARED for this incident, and therefore, the missing device hasn't been reported to anymore to take action. Containment would mean the period of time from the moment the incident had been reported until the time of first action or mitigation in the incident response plan. Since the question implies that there hasn't been any plan for such an incident, the failure was definitely somewhere in the preparation stage.

A. Containment In this case, the employee's device was missing for 96 hours before being reported. A missing device can potentially pose security risks if it contains sensitive data or access to the organization's network. The containment phase should involve taking swift action to minimize the potential impact of the incident. In this situation, the delay in reporting the missing device indicates a gap in the containment phase. Improvements are needed to ensure that incidents are reported promptly, and appropriate measures are taken to secure the missing device and assess the potential risks.

ChatGPT says: A. Containment In an incident response cycle, the containment phase involves taking actions to prevent the incident from further spreading or causing additional damage. In this case, the employee's device was missing for 96 hours before being reported, which suggests a delay in taking action to contain the situation. A missing device could potentially pose a security risk, and immediate action should have been taken to mitigate that risk by, for example, remotely locking or wiping the device if necessary.

missing device was not reported for 96 hours

The correct answer is B