GIAC Certified Incident Handler (GCIH) — Question 16

If an accounting department's computer system was compromised, who should make the decision about when that system is put back into production?

Answer options

• A. Lead incident handler, after recovery is complete
• B. Head of Information Systems or CIO
• C. System owner for that system
• D. System administrator for that system

Correct answer: A

Explanation

The lead incident handler is tasked with overseeing the recovery process and ensuring that all necessary measures are taken before the system is reinstated, making them the most qualified to decide when it can go back into production. The head of Information Systems or CIO, system owner, and system administrator may have roles in the process, but they are not directly responsible for the final decision regarding system restoration.