CompTIA CySA+ (CS0-003) — Question 208

Which of the following explains the importance of a timeline when providing an incident response report?

Answer options

• A. The timeline contains a real-time record of an incident and provides information that helps to simplify a postmortem analysis.
• B. An incident timeline provides the necessary information to understand the actions taken to mitigate the threat or risk.
• C. The timeline provides all the information, in the form of a timetable, of the whole incident response process including actions taken.
• D. An incident timeline presents the list of commands executed by an attacker when the system was compromised, in the form of a timetable.

Correct answer: C

Explanation

The correct answer is C because it highlights that the timeline encapsulates the entire incident response process, detailing all actions taken throughout. Options A and B focus on specific aspects of the timeline, while D narrows the scope to only the attacker's commands, not the overall incident response.