GIAC Exam GCED Topic 6 Question 22 Discussion

Actual exam question for GIAC's GCED exam

Question #: 22
Topic #: 6

Which action would be the responsibility of the First Responder once arriving at the scene of a suspected incident as part of a Computer Security Incident Response Plan (CSIRP)?

AMaking the decision of whether or not to notify law enforcement on behalf of the organization.

BPerforming timeline creation on the system files in order to identify and remove discovered malware.

CCopying critical data from suspected systems to known good systems so productivity is not affected by the investigation.

DConducting initial interviews and identifying the systems involved in the suspected incident.

Show Suggested Answer

Suggested Answer: D

The First Responder plays a critical role in the Incident Response process on the CSIRT (Computer Security Incident Response Team).

Here is a list of some typical responder tasks:

-- Make sure that the correct system is identified and photograph the scene, if necessary.

-- Conduct an initial interview (not an interrogation) of any witnesses.

The decision to notify law enforcement requires explicit approval and direction form management and/or counsel. While a First Responder may collect initial data while minimally intruding on the system, no major changes, or indepth media analysis should be performed by the First Responder when initially responding to a suspected incident.

by Belen at May 07, 2022, 01:07 AM

Limited Time Offer

25%

Off

Get Premium GCED Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Currently there are no comments in this discussion, be the first to comment!