1. Question 1: It is MOST important that your incident response policy do which of the following?

A) Align with overall business or agency security strategy

B) Make the incident response team more effective

C) Minimize the number of unsolved incidents

D) Ensure that no hacks go unnoticed

2. Question 2: Based on the introduction course and "IR definitions" module, which of the following is LEAST likely to be a triggering event?

A) Notification from a firewall

B) An article in the news about a new malware outbreak

C) Report from staff that systems are behaving in unusual ways

D) Notification from an IDS system

3. Question 3: Bob, the incident response manager, has just been given the task of building an internal IR team. Which of these steps should Bob execute first?

A) Obtain funding

B) Purchase new IR tools

C) Assess existing skill sets

D) Pick team members