GIAC Certified Incident Handler (GCIH) — Question 190

When containing an incident, who makes the final decision on whether a box should be taken offline?

Answer options

• A. IT auditor
• B. Law enforcement
• C. Incident handler
• D. Management
• E. Security department

Correct answer: E

Explanation

The correct answer is E, the Security department, as they typically have the authority and expertise to determine the security implications of taking a box offline. The other options, while involved in the incident response process, do not usually hold the final decision-making power regarding operational actions like taking a box offline.