In the event of a security incident, one of the primary objectives of the operations staff is to ensure that

A.
the attackers are detected and stopped.

B.
there is minimum disruption to the organization�s activities.

C.
appropriate documentation about the event is maintained as chain of evidence.

D.
the aff ected systems are immediately shut off to limit to the impact.

Explanation:
B: While the operations staff may be able to detect the attack and in some cases the attackers, there is very little that the operations staff can do to stop them. All actions taken by the operations staff as they respond to handle the security incident must follow established protocols and documented, but this is not their primary objective. Th e aff ected systems must only be shut off after necessary data or evidence that will be admissible in court is collected. Th e best answer choice is that the operations staff must maintain operational resilience; i.e., there is minimum disruption to the organizations activities. Page 542