A Computer Security Incident is defined as?

• A. A violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices.
• B. A routine software update for security patches.
• C. A scheduled penetration test.
• D. A disaster recovery drill.

Answer: (A)

The concept being tested is what qualifies as a computer security incident. A computer security incident is any violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices. This covers both actual breaches and situations where a breach is about to occur, which would prompt an incident response. Routine software updates are normal maintenance, not incidents. A scheduled penetration test is a planned assessment to discover vulnerabilities, not an incident. A disaster recovery drill is a preparedness exercise to test recovery capabilities, not an incident.