An engineer receives a report that indicates a possible incident of a malicious insider sending company information to outside parties. What is the first action the engineer must take to determine whether an incident has occurred?
A) Analyze environmental threats and causes
B) Inform the product security incident response team to investigate further
C) Analyze the precursors and indicators
D) Inform the computer security incident response team to investigate further

Question

Quizplus · Accepted Answer

The first action is to analyze the precursors and indicators to determine if there is evidence of an incident before escalating it to a response team.

An Engineer Receives a Report That Indicates a Possible Incident