What is incident response and why is it critical in MDC3?

• A. Incident response is a structured process to detect, contain, eradicate, recover from, and learn from security incidents; critical in MDC3 to minimize impact.
• B. It's only about reporting incidents to customers.
• C. It is optional in MDC3.
• D. It replaces patch management.

Answer: (A)

Incident response is a structured, repeatable process for handling security incidents, guiding teams from detection through containment, eradication, recovery, and learning. In MDC3, this matters because it minimizes damage by reducing how long an attacker remains active, stops the incident from spreading, and speeds restoration of services. It also ensures evidence is preserved for forensics, supports clear communication with stakeholders and regulators, and drives improvements to prevent recurrence.

The best choice captures the full lifecycle and the reason it matters: it’s not just about telling customers or filing a report, it’s proactive, technical, and involved. It isn’t optional in MDC3, since having a prepared, practiced response is essential to resilience. And it doesn’t replace patch management—patching prevents many incidents, while incident response deals with what happens when incidents occur despite patches, coordinating containment and recovery.