An auditor is reviewing the 'Incident Response' log. They see an entry: 'Server detected high CPU usage. Investigation showed it was a scheduled backup. Ticket closed.' Was this an 'Incident'?

Answer options:

No, this was an 'Event', not an 'Incident'.

Yes, any alert is an incident.

Yes, because it required investigation.

No, because no data was lost.

How to approach this question

Event = Something happened. Incident = Something BAD happened.

Full Answer

A.No, this was an 'Event', not an 'Incident'.✓ Correct

An 'Event' is any observable occurrence in a system. An 'Incident' is a violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices. A scheduled backup is a benign event.

Common mistakes

Using the terms interchangeably.

Question 78 All questions Question 80

Practice the full CPA ISC Practice Exam

82 questions · hints · full answers · grading

More questions from this exam

Q01A CPA is performing a risk assessment for a client that uses a public cloud provider for its core...Hard Q02During a walkthrough of a client's change management process, the auditor notes that developers h...Hard Q03A service organization provides a real-time transaction processing platform. The service level ag...Hard Q04An auditor is reviewing a SQL query used by the finance team to generate a report of all sales tr...Hard Q05A healthcare clearinghouse is preparing for a SOC 2® engagement. They utilize a private cloud dep...Hard

View all 82 questions →