Why should a Tier 1 analyst escalate an uncertain alert on Harborline's payment server as opposed to close it? A. Uncertainty on critical assets needs wider context B. Accountability for triage moves to the incident manager C. Escalation activates the ATM disaster recovery plan D. Escalation clears the queue for routine alerts THE SCENARIO · Harborline Bank · security operations center · PCI DSS · FFIEC · 4,000 alerts a day · under 1% actionable · supplier VPN into payment systems · Intrusion ran fourteen days before anyone looked The answer, why it is right, and why each of the other three is wrong — all in the video. Domain 1: Security and Risk Management ISC2 CISSP exam outline: 7.6.2 Question #30 of the SecurePath Digital CISSP practice series Practice for the CISSP exam with me. Follow for a question a day, worked through end to end. #CISSP #CISSPExam #CyberSecurity #InfoSec #ISC2 #RiskManagement #SecurityGovernance