Exam SY0-601 topic 1 question 270 discussion

Answer: Preparation The preparation phase is when the organization is preparing for the attack. Tuning the SIEM is just providing the latest threat information to the system for preparation. ======================= Phases of the Incident Response Plan: 1. Preparation - Preparing for an attack and how to respond 2. Identification - Identifying the threat 3. Containment - Containing the threat 4. Eradication - Removing the threat 5. Recovery - Recovering affected systems 6. Lessons Learned - Evaluating the incident response, see where there can be improvements for a future incident.

I say A. It saids. Based on reports. The incident happen before therefore so SIEM got tuned

Why drop report? Its automatic app, always prepared to response any attack or i am wrong?

During the Preparation phase, an organization takes proactive steps to enhance its incident response capabilities and readiness. This includes activities such as tuning SIEM (Security Information and Event Management) rules based on threat intelligence reports. By analyzing and incorporating threat intelligence into the SIEM rules, the organization can enhance its ability to detect and respond to potential security incidents. The Preparation phase focuses on activities aimed at preventing and mitigating potential incidents, improving detection and response capabilities, and ensuring that necessary tools, processes, and resources are in place to effectively respond to security events. It involves tasks such as developing incident response plans, defining roles and responsibilities, establishing communication channels, implementing security controls, and conducting regular training and exercises.

That’s D. Why? The organization learned about new threats/vulnerabilities from these threat intelligence reports that made them tune (tweak) their SIEM rules.

They simply received intelligence reports. They are adjusting their defenses in PREPARATION for an attack. Now if this was after an attack then in would fall into the correction category.

Lessons learned A for me.

Agree with D here