Which role plays detective on the affected network in order to determine what happened?

Which role plays detective on the affected network in order to determine what happened?

• A. Forensic Analyst
• B. Incident Response Manager
• C. Triage Analyst
• D. Threat Researchers

Answer: (B)

In incident response, the person who acts as the investigator on the scene, guiding the discovery of what happened, is the Incident Response Manager. This role oversees the entire investigation: coordinating evidence collection, preserving integrity, and outlining the timeline, scope, and impact of the incident. They set the plan, assign tasks to specialists, and communicate findings to stakeholders. While a Forensic Analyst digs into logs and artifacts to reconstruct the technical sequence of events, the manager leads the detective work across the team, ensuring that the investigation is thorough and coordinated. Triage Analysts handle initial prioritization, and Threat Researchers analyze attacker techniques and trends, but they are not the primary detective directing the incident investigation.

In incident response, the person who acts as the investigator on the scene, guiding the discovery of what happened, is the Incident Response Manager. This role oversees the entire investigation: coordinating evidence collection, preserving integrity, and outlining the timeline, scope, and impact of the incident. They set the plan, assign tasks to specialists, and communicate findings to stakeholders. While a Forensic Analyst digs into logs and artifacts to reconstruct the technical sequence of events, the manager leads the detective work across the team, ensuring that the investigation is thorough and coordinated. Triage Analysts handle initial prioritization, and Threat Researchers analyze attacker techniques and trends, but they are not the primary detective directing the incident investigation.