Performing CyberOps Using Cisco Security Technologies (CBRCOR) — Question 93

An engineer receives a report that indicates a possible incident of a malicious insider sending company information to outside parties. What is the first action the engineer must take to determine whether an incident has occurred?

Answer options

• A. Analyze environmental threats and causes
• B. Inform the product security incident response team to investigate further
• C. Analyze the precursors and indicators
• D. Inform the computer security incident response team to investigate further

Correct answer: D

Explanation

The correct answer is D because informing the computer security incident response team is crucial for a thorough investigation of the potential incident. Options A and C focus on analysis rather than immediate action, while option B involves the product security team, which may not be the appropriate team for this specific incident.