Incident Response Process for CySA+: Preparation Through Lessons Learned

The CompTIA CySA+ CS0-003 exam tests your ability to detect, analyze, and respond to security incidents. A structured incident response (IR) process is central to this. The official CompTIA model follows six phases: Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned. This post breaks down each phase with technical specifics, real-world examples, and exam-critical details.

Preparation

Preparation is the foundation. Without it, every other phase becomes chaotic. The exam expects you to know the key components:

• Policies and procedures: Incident response plan (IRP), communication plan, escalation matrix.
• Tools and resources: SIEM (e.g., Splunk, ELK), EDR (e.g., CrowdStrike, Microsoft Defender for Endpoint), forensic workstations, jump boxes, and packet capture tools (tcpdump, Wireshark).
• Training and exercises: Tabletop exercises, red team/blue team drills, and regular updates to playbooks.

Example: A financial institution prepares by deploying Sysmon on all endpoints to log process creation and network connections. They configure a SIEM to alert on suspicious Sysmon Event ID 1 (process creation) with unusual parent-child relationships, like winword.exe spawning powershell.exe.

Identification

Identification is where detection meets analysis. You must recognize indicators of compromise (IOCs) and validate alerts. Key concepts for the exam:

• IOC types: File hashes, IP addresses, domain names, registry keys, patterns of behavior.
• Alert triage: Determine true positive vs. false positive. Use sandboxing (e.g., Cuckoo) or threat intelligence feeds (e.g., VirusTotal, AlienVault OTX).
• Data sources: Logs from firewalls (e.g., denied outbound connections), DNS logs (NXDOMAIN responses), NetFlow, and Windows Event Logs (Event ID 4625 for failed logins).

Example: A SIEM alert fires for multiple failed logins (Event ID 4625) from a single IP to multiple accounts. The analyst checks the source IP against threat intel—it's a known brute-force scanner. They confirm the alert as a true positive.

Containment

Containment stops the incident from spreading. The exam covers short-term and long-term containment strategies:

• Short-term: Disable the compromised account, block the attacker IP on the firewall (e.g., iptables -A INPUT -s 10.0.0.5 -j DROP), isolate the host via network access control (NAC) or EDR.
• Long-term: Apply patches, change passwords, implement network segmentation (VLANs, ACLs).
• Forensic considerations: Capture memory (using memdump or FTK Imager) before powering off. Take a disk image (using dd or Guymager) for later analysis.

Example: A server is infected with ransomware. The team uses EDR to isolate the host from the network immediately. They then capture a memory dump using avml and a disk image using dd if=/dev/sda of=/mnt/evidence/image.dd.

Eradication

Eradication removes the threat from the environment. This phase often overlaps with containment. Key actions:

• Remove malware: Use EDR to quarantine files, run antivirus scans with up-to-date signatures, or reimage the system.
• Close vulnerabilities: Patch exploited software (e.g., CVE-2021-44228 for Log4j), disable unnecessary services, revoke compromised certificates.
• Verify removal: Re-scan systems, check for persistence mechanisms (e.g., scheduled tasks, registry Run keys, WMI subscriptions).

Example: After containing a web shell attack, the team removes the malicious PHP file, patches the vulnerable web application (Apache Struts), and runs grep -r 'base64_decode' /var/www/html to find any hidden backdoors.

Recovery

Recovery restores normal operations. The exam emphasizes validation and monitoring:

• Restore from backups: Ensure backups are clean and tested. Use offline backups to avoid re-infection.
• Monitor closely: Increase log review frequency, look for re-infection attempts, verify that firewall rules and EDR policies are effective.
• Communication: Notify stakeholders (management, legal, PR) as per the IRP.

Example: A database server is restored from a backup taken 24 hours before the incident. The team monitors SQL Server error logs and firewall logs for any suspicious outbound connections from the database server for 48 hours.

Lessons Learned

This final phase is critical for continuous improvement. The exam tests your ability to produce a post-incident report and update processes.

• Post-incident report: Include timeline, root cause, actions taken, evidence collected, and recommendations.
• Update playbooks: Revise detection rules, add new IOCs to threat intel, improve containment steps.
• Training: Address gaps identified—e.g., if the incident was missed due to lack of log correlation, train analysts on SIEM querying.

Example: After a phishing incident, the team updates the SIEM with a new correlation rule: alert on any user who clicks a link in an email and then attempts to connect to an external IP on port 445 (SMB). They also add a training module on phishing awareness.

Exam Tips: What to Watch For

• Order matters: The phases are sequential, but containment and eradication can overlap. The exam expects you to know the correct order for multiple-choice scenarios.
• Know the tools: Be familiar with common forensic tools like dd, FTK Imager, Wireshark, and tcpdump. Also know EDR and SIEM capabilities.
• Ports and protocols: Recognize suspicious traffic: outbound SMB (port 445) to an external IP, DNS queries to known malicious domains, or HTTP POSTs to /upload.php.
• Chain of custody: For any question involving evidence, remember to document who, what, when, where, and how. Use hashing (SHA-256) to verify integrity.
• False positives: The exam often presents noisy alerts. Use threat intelligence and context to differentiate.

Conclusion

Mastering the six-phase incident response process is essential for the CySA+ exam and real-world security operations. Focus on the technical details—commands, logs, and tools—and practice applying the phases to realistic scenarios. To solidify your knowledge, work through practice questions that present incident timelines and ask you to identify the next correct step. Try our free CySA+ practice quiz to test your skills. Good luck!

For more practice, visit CySA+ Practice Questions (link placeholder).