According to CERT, must an incident be a real adverse event?

• A. True
• B. False
• C. Not sure
• D. It depends

Answer: (B)

In CERT terms, an incident covers more than just events that cause real harm. A security incident is any event that violates or could violate computer security policies, including attempts or near-misses that are detected or blocked, as well as actual breaches. So an incident does not have to be a real adverse event; it can be an attempted intrusion, suspicious activity, or a policy violation that prompts investigation. That’s why the statement is false: CERT recognizes incidents that may not result in realized damage but still require follow-up and containment. For example, a failed login, a port scan, or a malware alert that is blocked are all incidents, even though no harm occurred.