Exam 212-89 topic 1 question 30 discussion

Actual exam question from ECCouncil's 212-89

Question #: 30
Topic #: 1

One of the main objectives of incident management is to prevent incidents and attacks by tightening the physical security of the system or infrastructure. According to CERT's incident management process, which stage focuses on implementing infrastructure improvements resulting from postmortem reviews or other process improvement mechanisms?

A. Protection
B. Preparation
C. Detection
D. Triage

Show Suggested Answer

Suggested Answer: A 🗳️

by Cherryyyy at June 10, 2023, 2:11 p.m.

Comments

Submit Cancel

jacklin

6 months, 3 weeks ago

I noticed something interesting about this question. The CERT incident management process actually consists of four standard phases: Preparation Detection & Analysis Containment, Eradication & Recovery Post-Incident Activity/Lessons Learned Protection isn't a standard phase in this process. Infrastructure improvements typically come from the Lessons Learned phase and then get implemented during the next Preparation cycle. Since Lessons Learned isn't an option here, we might consider either: Preparation (as it's where improvements get implemented) or ask for clarification since the question includes a non-standard phase Would be interested to hear others' thoughts on this.

upvoted 2 times

...