200-201 Security Policies and Procedures Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Determining data breach notification requirements

  Why this is correct

  Legal counsel advises on legal obligations to notify affected parties.

• ✗

  Communicating with the media

  Why it's wrong here

  Media liaison belongs to public relations or communications, who craft messaging under counsel's legal review; counsel's remit covers disclosure obligations, privilege and regulatory reporting. It tempts because counsel frequently approves what may be said publicly, but delivering statements to journalists is a communications function, not a legal responsibility.

• ✗

  Conducting technical analysis of malware

  Why it's wrong here

  Malware analysis is a technical task performed by incident responders or forensic analysts, not legal counsel, whose duties cover regulatory notification, evidence handling and liability. It is tempting because counsel may review technical findings, but conducting the analysis itself falls outside the legal role.

• ✗

  Approving financial expenditures for containment

  Why it's wrong here

  Legal counsel advises on regulatory notification duties, preservation obligations and privilege; budget approval sits with the incident response manager or executive sponsor holding financial authority. It tempts because counsel often sits on the steering committee where costs are discussed, but authorising containment spend is a business decision, not a legal one.

• ✓

  Issuing a legal hold to preserve relevant data

  Why this is correct

  Legal hold suspends normal data retention and deletion so that logs, disk images and correspondence relevant to the incident are preserved for litigation or regulatory scrutiny. This is a legal counsel responsibility, distinct from the forensic collection performed by incident responders.

Go deeper

Related to this question