Question

A security analyst at a financial services firm notices unusual outbound traffic from a database server during routine monitoring. The analyst is unsure whether this rises to the level of a formal security incident that should activate the incident response team. Which of the following would MOST effectively help the analyst make this determination consistently?

Accepted Answer

Predefined incident declaration criteria based on classification and severity thresholds

Answer

A more detailed network diagram showing all database server connections

Answer

Escalating every anomaly directly to the CISO for a decision

Answer

A post-incident review report from a previous data exfiltration event