GIAC Certified Incident Handler (GCIH) — Question 64

What is the first decision point of an incident investigation?

Answer options

• A. Criticality
• B. Preparation
• C. Verification
• D. Detection

Correct answer: D

Explanation

The correct answer is D, Detection, as it is the first phase where an incident is identified. The other options, while important in the investigation process, come after detection and involve assessing the impact, preparing resources, and verifying facts of the incident.