Which term describes the role that oversees and prioritizes actions during the detection, analysis, and containment of an incident?

• A. Incident Commander
• B. Security Analyst
• C. Tabletop Exercise
• D. Rules of Engagement

Answer: (D)

The leadership role that coordinates and prioritizes actions across detection, analysis, and containment is the Incident Commander. This person acts as the overall lead for the incident response, setting objectives, approving strategies for containment and eradication, and directing the responders to ensure work is prioritized effectively. They maintain situational awareness, communicate with stakeholders, and manage resources and timelines so the incident is handled in a controlled, coordinated way. In contrast, a Security Analyst focuses on monitoring and analyzing events, a Tabletop Exercise is a training activity to practice responses, and Rules of Engagement defines the policy for how threats should be engaged—useful context but not the day-to-day leadership role that oversees the incident.