Refer to the Exhibit

Multiple Choice

Refer to the exhibit. What activity should occur during the baseline phase, according to the risk reduction model?

A) Define and build the incident response team
B) Monitor incidents and tune the policy to reduce false positives
C) Establish business metrics and begin sending reports to business unit stakeholders
D) Test policies to ensure that blocking actions minimize business process disruptions