An incident response manager has started to gather all the facts related to a SIEM alert showing multiple systems may have been compromised. The manager has gathered these facts: The breach is currently indicated on six user PCs One service account is potentially compromised Executive management has been notified In which of the following phases of the IRP is the manager currently working?

Question

Quizplus · Accepted Answer

The manager is in the Identification phase, as they are gathering facts and determining the scope and nature of the incident.

An Incident Response Manager Has Started to Gather All the Facts