Questions

1. Why is mission a key element of an incident response plan?
   1. The IT team mission will dictate when a CSIRT is mobilized away from their day-to-day roles.
   2. The organization's mission will dictate which actions cannot be taken.
   3. The CSIRT mission will dictate what the team's priorities are.
   4. Every CSIRT's mission is the same, so including it in the plan informs senior management of this.
2. NIST guidelines suggest that metrics are included in the incident response plan. What are these metrics there for?
   1. To measure the effectiveness of the plan
   2. To measure the severity of the incident before triggering the plan
   3. To measure the risk associated with the plan
   4. To quantify the value of the CSIRT
3. Which of the following are actions within the preparation stage of incident management?
   1. Collecting and documenting evidence
   2. Training the CSIRT on the systems and technologies...