200-201 Security Policies and Procedures Practice Question

During which phase of the NIST SP 800-61 Rev 2 incident response process should an organization develop and exercise the incident response plan?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Preparation

Preparation includes creating the IR plan, team, tools, and conducting exercises. The other phases occur after an incident is detected.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Preparation
Why this is correct
Preparation is the first phase where the IR plan, team, and tools are established and exercised.
✗
Post-Incident Activity
Why it's wrong here
This phase involves lessons learned and updating the plan after an incident.
✗
Detection and Analysis
Why it's wrong here
This phase involves identifying and triaging incidents, not preparing the plan.
✗
Containment, Eradication, and Recovery
Why it's wrong here
This phase focuses on containing and remediating incidents.

Go deeper