- A table-top exercise should be conducted after changes are made to the incident response plan and/or playbooks.
A) True
B) False
- Which of the following roles would not be a member of the CSIRT core team?
A) Incident coordinator
B) CSIRT analyst
C) Legal
- It is not important to have technical resources available as part of the incident response framework to aid during an incident.
A) True
B) False
- The risk assessment is a valid data source for identifying high-risk incidents for playbook creation.
A) True
B) False
