• Question 24 When responding to an incident , when does the IRT timeline start ?
• Question 25 During which phase of incident response do IRT members study the attack and develop recommendations to prevent similar attacks in the future ?
• Question 26 Before an incident can be declared , the IRT must develop an incident ________ for incident response .
• Question 27 FISMA requires federal agencies to report major incidents to which organization ?