Establishing logging, monitoring, and response procedures for security incidents occurs during:

Question

BlackTom AI · Accepted Answer

Establishing logging, monitoring, and response procedures for security incidents is an operational implementation task carried out during Deployment because it involves configuring production systems, integrating operational tools, and putting incident-response runbooks into place.

1. Relevant knowledge points and concepts
- Secure SDLC/phases: Design (requirements/architecture), Development/Testing (build and validate), Deployment (release and operational configuration), Maintenance/Operations (ongoing run and tune).
- Logging and monitoring: configuring logs, log retention, centralization (SIEM), alerting thresholds.
- Incident response procedures: playbooks, escalation paths, contact lists, runbooks, tabletop exercises and tooling integration.

2. Step-by-step reasoning
- In Design you define logging and monitoring requirements (what events to capture, retention policy, roles).
- During Testing you validate that the logging and monitoring mechanisms work (generate events, verify collection, check alerting).
- During Deployment you take the defined requirements and tested mechanisms and actually configure production systems: enable log forwarding, install and configure SIEM/agents, configure alerting rules and thresholds, publish incident response runbooks, assign on-call rotations and contact points, and run production readiness checks.
- During Maintenance you operate, tune, and update those controls and respond to incidents when they occur.

3. Intermediate steps (implementation examples)
- Enable syslog/agent on servers and applications.
- Configure SIEM ingest and parsing rules, set retention.
- Create alert rules and notification channels (email/SMS/pager).
- Publish incident response playbooks and notify the SOC/on-call team.
- Perform a production smoke test and a tabletop drill.

4. Why the correct answer is correct
Deployment is the phase where the system is put into production and operational controls are actually implemented; that is when logging, monitoring, and formal response procedures must be established and activated so the system is ready to be observed and incidents can be handled.

5. Why other options are incorrect
- Design: defines requirements and architecture but does not implement operational controls.
- Testing: verifies logging/alerts work but does not constitute the production rollout of those measures.
- Maintenance: involves ongoing operation and tuning of monitoring and incident response, but the initial establishment occurs at Deployment.

6. Conclusion
Therefore, the correct answer is Deployment, which matches the provided answer.

Establishing logging, monitoring, and response procedures for security incidents occurs during:单项选择题

类似问题

What is the primary purpose of the Act stage in the OODA loop?

Which of the following Incident handling process phases is responsible for defining rules, collaborating human workforce, creating a back-up plan, and testing the plans for an enterprise?

When developing an Incident Response Plan, you need procedures that ensure _________.

An Incident Response Plan does NOT _________.

A project has a required return of 12.6 percent, an initial cash outflow of $42,100, and cash inflows of $16,500 in Year 1, $11,700 in Year 2, and $10,400 in Year 4. What is the net present value?

更多留学生实用工具

智能学习助手

风格化写作助手

论文查重助手

文献引用助手

课堂转译助手

课堂笔记助手

Quiz搜索助手

学校历年真题

智能刷题助手

智能匹配练习

希望你的学习变得更简单