Question 110
Main Page
During an incident response test, a team member uses undocumented procedures. What’s the appropriate follow-up?
A. Praise the initiative
B. Update the response plan to include what was done
C. Discard test results
D. Avoid documenting to maintain flexibility
Answer: Update the response plan to include what was done
Plans should evolve based on real-world use; if undocumented actions are effective, they should be formally included.