contestada

After an incident, but before returning to its normal duties, the CSIRT must do which of the following?a. create the incident damage assessmentb. conduct an after-action reviewc. restore data from backupsd. restore services and processes in use

Respuesta :

Martebi

After an incident, but before returning to its normal duties, the CSIRT must do option b. conduct an after-action review.

What does a CSIRT do?

The CSIRT is a neutral organization having the resources and technical expertise needed to respond to computer security issues. The CSIRT is in charge of locating the occurrences, taking control of them, alerting the designated CSIRT responders, and informing management of its findings.

Hence, The disaster recovery (DR) plan is activated first during an occurrence, followed by the incident response (IR) plan. The COO is often in charge of developing the IR plan. The site may be fully operational in a warm location in a matter of minutes because all services and communications links are fully configured.

Learn more about incident from

https://brainly.com/question/13071753
#SPJ1