Which option best describes what incident reporting should include?

Which option best describes what incident reporting should include?

• A. System uptime and patch level
• B. Marketing impact
• C. Intensity, vulnerability, design/impact, intruder's activity
• D. User IDs and passwords

Answer: (C)

Incident reports should document the key facts that help responders understand what happened, how severe it was, which weakness was exploited, what systems were affected, and what the attacker did. The best choice captures the incident’s intensity or severity, the vulnerability that was exploited, the design/operational impact, and the intruder’s activity. This provides the essential context for containment decisions, root-cause analysis, and future prevention, and it guides what needs to be fixed and how. Other details like system uptime and patch level are supporting context but don’t by themselves describe the incident’s scope or cause. Marketing impact isn’t relevant to the security event, and exposing user IDs and passwords in an incident report would be inappropriate due to confidentiality and security risks.

Incident reports should document the key facts that help responders understand what happened, how severe it was, which weakness was exploited, what systems were affected, and what the attacker did. The best choice captures the incident’s intensity or severity, the vulnerability that was exploited, the design/operational impact, and the intruder’s activity. This provides the essential context for containment decisions, root-cause analysis, and future prevention, and it guides what needs to be fixed and how.

Other details like system uptime and patch level are supporting context but don’t by themselves describe the incident’s scope or cause. Marketing impact isn’t relevant to the security event, and exposing user IDs and passwords in an incident report would be inappropriate due to confidentiality and security risks.