200-201 Security Policies and Procedures Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Make decisions about business impact

  Why it's wrong here

  Business impact decisions rest with executive management or the incident commander, who weigh operational continuity; legal counsel assesses regulatory, contractual and liability exposure. It is tempting because counsel informs those decisions, but counsel would be correct where the question concerns notification duties or evidence preservation.

• ✗

  Communicate with the public

  Why it's wrong here

  Public communication belongs to communications or public relations staff, who follow approved messaging; legal counsel advises on disclosure obligations and liability instead. It is tempting because breach notification is legally driven, but counsel would be correct where the question concerns regulatory reporting thresholds or privilege.

• ✗

  Conduct forensic analysis of affected systems

  Why it's wrong here

  Forensic analysis is performed by digital forensics examiners, who preserve and examine evidence under chain of custody; legal counsel instead guides privilege, disclosure and regulatory obligations. It is tempting because counsel often directs the investigation, but counsel would be correct where the question concerns legal hold or breach notification.

• ✓

  Advise on data breach notification requirements

  Why this is correct

  Legal counsel interprets breach notification statutes and contractual obligations, advising when and to whom affected parties and regulators must be told. This satisfies the stem's data breach scenario, since notification deadlines and wording carry legal weight distinct from technical containment or forensic analysis.

Go deeper

Related to this question