Which planning activity most directly establishes who has authority to make incident response decisions?
Answer
Approving an incident response policy
Explanation
### Why this is right
An approved policy establishes authority, roles, and responsibilities before an incident occurs.
### The concept
Procedures explain how to perform tasks; policy establishes organizational direction and accountability.
### The other options
- **B. Capturing full network packets**: collects technical evidence, not decision authority.
- **C. Restoring systems from backups**: supports recovery after an incident.
- **D. Collecting threat intelligence**: informs planning but does not assign authority.
### Remember
Set authority and responsibility before an incident, not during one.
Related Questions
- Which of the following is an example of an adversary attack activity, as opposed to a system vulnerability or a defensive measure? (Select all that apply.)(intermediate)
- Which information is most directly useful when coordinating technical response across teams?(basic)
- Attackers necessarily complete all life-cycle stages quickly, so extended monitoring is unnecessary.(basic)
- The foundational three-stage model of organizational change consisting of Unfreeze, Change, and Refreeze was introduced by social psychologist Kurt _____.(basic)
- Select ALL elements that belong in a documented cyber risk assessment.(intermediate)
Want to practice more questions like this?
Join myBenkio free and practice past questions for your Nigerian university courses with AI explanations for every answer.
Start Practicing Free