200-201 Practice Question: An organization's security policy requires that…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Delete the logs to avoid false alarms

  Why it's wrong here

  Deleting logs destroys the evidence needed to investigate the unauthorised login attempt and breaches the reporting policy outright. It is tempting only as a misguided way to suppress false alarms, but log retention is required for incident response; the analyst must report the suspected incident and preserve all associated evidence intact.

• ✗

  Wait until the incident is confirmed

  Why it's wrong here

  Waiting for confirmation delays reporting past the one-hour policy window, and the analyst lacks the authority to make that determination alone. It is tempting because confirming an incident before escalation avoids false alarms, but the policy requires reporting suspected incidents immediately; triage and confirmation belong to the incident response team, not the discovering analyst.

• ✗

  Investigate on their own without reporting

  Why it's wrong here

  Investigating alone consumes the one-hour reporting window and withholds the unauthorised login attempt from the response team. It is tempting because gathering evidence before escalating appears diligent, but the policy mandates prompt reporting of suspected incidents; independent investigation is appropriate only after the incident has been reported and assigned.

• ✓

  Report the suspicious activity immediately

  Why this is correct

  The one-hour reporting mandate applies from discovery, and uncertainty about classification does not justify delay. Reporting the suspicious activity immediately lets the security team triage whether it qualifies as an incident, satisfying the policy's timeframe while preserving evidence and enabling containment.

Go deeper

Related to this question