• Question 24 When responding to an incident, when does the IRT timeline start?
• Question 25 During which phase of incident response do IRT members study the attack and develop recommendations to prevent similar attacks in the future?
• Question 26 Before an incident can be declared, the IRT must develop an incident ________ for incident response.
• Question 27 FISMA requires federal agencies to report major incidents to which organization?