Follow-Up activities include which of the following?

• A. Penetration testing of external interfaces.
• B. Follow-Up activities include which of the following? Additional monitoring, network sweeps for new breaches, and auditing the network for compliance.
• C. Verifying backups and disaster recovery drills.
• D. User awareness training.

Answer: (B)

After an incident, the focus is on validating remediation and ensuring long-term security. Follow-up activities center on monitoring for signs of compromise, scanning for new breaches, and auditing the network for compliance and control effectiveness. These steps help confirm that threats have been contained, prevent recurrence, and provide data to improve defenses.

Penetration testing of external interfaces is a proactive security test done to identify vulnerabilities before or outside of incident response. Verifying backups and conducting disaster recovery drills belong to recovery readiness and business continuity, not the ongoing follow-up monitoring and auditing after an incident. User awareness training is a preventive measure aimed at reducing risk through education, not a direct follow-up activity after an incident.