CompTIA Security Exam Practice Questions Sample SY0 501 Q161

A director of IR is reviewing a report regarding several recent breaches. The director complies the following statistics:
– Initial IR engagement time frame
– Length of time before an executive management notice went out
– Average IR phase completion
The director wants to use data to shorten the response time. Which of the following would accomplish this?

A. CSIRT
B. Containment phase
C. Escalation notifications
D. Tabletop exercise

Correct Answer: D