CompTIA Security Exam Practice Questions Sample SY0 501 Q138

A director of IR is reviewing a report regarding several recent breaches. The director compiles the following statistic’s
-Initial IR engagement time frame
-Length of time before an executive management notice went out
-Average IR phase completion
The director wants to use the data to shorten the response time. Which of the following would accomplish this?

A. CSIRT
B. Containment phase
C. Escalation notifications
D. Tabletop exercise

Correct Answer: D