Certified Incident Handler (CIH) Practice Ecam

In an incident response scenario, what is vital for effective communication regarding user behavior?

1. Discuss user restrictions with the HR department

2. Coordinate with the IT support team

3. Engage with the physical security team

4. Update user access rights

The correct answer is: Engage with the physical security team

Effective communication regarding user behavior in an incident response scenario is crucial for understanding the context and potential impact of the incident. Engaging with the physical security team is vital because they have insights into the physical interaction of users within a facility and can provide valuable information regarding any suspicious activities or unauthorized access. This collaboration ensures that all aspects of security—both physical and digital—are considered when assessing user behavior and responding to incidents. The role of physical security extends beyond merely monitoring access; they can offer intelligence on any anomalies in user behavior that may indicate malicious intent or security breaches. Their involvement can help build a comprehensive understanding of the incident, allowing for more informed decision-making during incident response. While coordination with IT support or discussing restrictions with HR is important in their own right, they do not provide the same critical perspective on the physical aspects of user behavior that the physical security team can offer. Likewise, updating user access rights addresses a different aspect of security that does not directly contribute to understanding user behavior during an incident. Thus, involving the physical security team is essential for a holistic view of incidents involving user actions.