312-39 › Incident Response
This domain covers the NIST Incident Response lifecycle: preparation, detection and analysis, containment, eradication, recovery, and post-incident activity. Questions test phase identification, severity scoring, phishing indicators, and dwell time factors. Expect scenario-based items requiring you to classify activities, prioritize incidents, and select appropriate response actions within the SOC analyst role.
312-39 Incident Response — All 72 Questions
Every question in this domain with answers and detailed explanations.