Which one of the following is NOT a factor to consider when establishing a core incident response te

Which one of the following is NOT a factor to consider when establishing a core incident response
team?

A.
Technical knowledge

B.
Communication skills

C.
The recovery capability

D.
Understanding business policy

Explanation:
The team should have someone from senior management, the network administrator, security
officer, possibly a network engineer and /or programmer, and liaison for public affairs…The incident
response team should have the following basic items List of outside agencies and resources to
contact or report to List of computer or forensics experts to contact Steps on how to secure and
preserve evidence Steps on how to search for evidence List of items that should be included on the
report A list that indicates how the different systems should be treated in this type of situation
(removed from internet, removed from the network, and powered down) – Shon Harris All-in-one
CISSP Certification Guide pg 671-672 an investigation should involve management, corporate
security, human resources, the legal department, and other appropriate staff members. The act of
investigating may also affect critical operations…Thus it is important to prepare a plan beforehand
on how to handle reports of suspected computer crimes. A committee of appropriate personnel
should be set up beforehand to address the following issues Establishing a prior liaison with law
enforcement Deciding when and whether to bring in law enforcement… Setting up means of
reporting computer crimes Establishing procedures for handling and processing reports of computer
crime Planning for and conducting investigations Involving senior management and the appropriate
departments, such as legal, internal audit, information systems, and human resources Ensuring the

proper collection of evidence, which includes identification and protection of the various storage
media. -Ronald Krutz The CISSP PREP Guide (gold edition) pg 435-436