Bank analysts build a contact tree and a severity chart before any incident has occurred this year. Which incident-handling phase is that work?
Select an answer to reveal the explanation.
Short Explanation
Packing the go-bag and writing down phone numbers happens before the trip, not after you get home. You are arranging contacts and severity guidance with no incident open this year. The trap is live detection work, recovery on a compromised system, or a lessons review of an incident that has not happened.
Full Explanation
Preparation, done by arranging the contact tree and severity chart before any incident is the phase. A contact tree and a severity chart are built so the bank knows who to call and how to grade an event before one exists. That advance arrangement is preparation, and the stem places it before any incident this year. Detection and analysis while analysts judge a live alert and decide if it is an incident is the work of judging a live alert. There is no alert and no decision about a current event in this task, so the analysts are not in detection and analysis. Containment, eradication, and recovery on a bank system that is already compromised applies when a system is already compromised and the team is limiting damage, removing the cause, and restoring service. Nothing in the stem is compromised yet. Post-incident analysis that reviews the handling after affected systems are restored reviews handling after an incident has been worked and systems are restored. With no incident this year, there is no completed handling to review. Exam caveat: NIST SP 800-61 Rev. 3 maps preparation onto CSF 2.0 Functions. The exam still wants the phase name preparation, and the four familiar names are not Rev. 3's only model. Operational check: confirm the on-call roster matches the contact tree and that analysts are told to use this severity chart when the next event actually arrives.