A. It is a reactive process that is only initiated after an incident has occurred.
B. It is a proactive process that focuses on preventing incidents from occurring.
C. It is an iterative process that involves continuous improvement based on lessons learned.
D. It is a one-time process that is only performed when an organization first establishes its security program.
Explanation:
Option 1: Incorrect. The incident response process can be both proactive and reactive. While it does involve reacting to incidents that have already occurred, it also includes proactive measures to prevent incidents from happening again in the future.
Option 2: Incorrect. While incident response can involve proactive measures to prevent incidents, it is not solely focused on prevention. It also includes reacting to incidents that have already occurred.
Option 3: Correct. The incident response process is an iterative process that involves continuous improvement based on lessons learned. Organizations should regularly review and update their incident response plans to ensure they are effective and up to date.
Option 4: Incorrect. The incident response process is not a one-time process. It should be an ongoing and continuous process to address security incidents as they occur and to improve the incident response
capabilities of the organization.
