ExpertEasy1 markMultiple Choice
CPA · Question 79 · Area II: Security
An auditor is reviewing the 'Incident Response' log. They see an entry: 'Server detected high CPU usage. Investigation showed it was a scheduled backup. Ticket closed.' Was this an 'Incident'?
An auditor is reviewing the 'Incident Response' log. They see an entry: 'Server detected high CPU usage. Investigation showed it was a scheduled backup. Ticket closed.' Was this an 'Incident'?
Answer options:
A.
No, this was an 'Event', not an 'Incident'.
B.
Yes, any alert is an incident.
C.
Yes, because it required investigation.
D.
No, because no data was lost.
How to approach this question
Event = Something happened. Incident = Something BAD happened.
Full Answer
A.No, this was an 'Event', not an 'Incident'.✓ Correct
An 'Event' is any observable occurrence in a system. An 'Incident' is a violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices. A scheduled backup is a benign event.
Common mistakes
Using the terms interchangeably.
Practice the full CPA ISC Practice Exam
82 questions · hints · full answers · grading
More questions from this exam
Q01A CPA is performing a risk assessment for a client that uses a public cloud provider for its core...HardQ02During a walkthrough of a client's change management process, the auditor notes that developers h...HardQ03A service organization provides a real-time transaction processing platform. The service level ag...HardQ04An auditor is reviewing a SQL query used by the finance team to generate a report of all sales tr...HardQ05A healthcare clearinghouse is preparing for a SOC 2® engagement. They utilize a private cloud dep...Hard