Questions

Test your knowledge by seeing if you can answer the following questions:

1. A table-top exercise should be conducted after changes are made to the IR plan and/or playbooks.
   1. True
   2. False
2. Which of the following roles would not be a member of the CSIRT core team?
   1. Incident coordinator
   2. CSIRT analyst
   3. Legal
3. It is not important to have technical resources available as part of the IR framework to aid during an incident.
   1. True
   2. False
4. A risk assessment is a valid data source for identifying high-risk incidents for playbook creation.
   1. True
   2. False