Incident Response and Management (20%)CS0-003 Study Guide

Incident Categories and Severity

Objective 3.1 · Incident Response

Incident Response Process

Objective 3.2 · Incident Response

Digital Forensic Evidence Collection

Objective 3.3 · Incident Response

Containment and Eradication

Objective 3.4 · Incident Response

NIST Incident Response Framework

Objective 3.2 · Incident Response

Memory Forensics and Volatile Data

Objective 3.3 · Incident Response

Network Forensics: Packet Capture Analysis

Objective 3.3 · Incident Response

Legal Considerations in Incident Response

Objective 3.4 · Incident Response

Root Cause Analysis (RCA)

Objective 3.4 · Incident Response

Lessons Learned and Post-Incident Activities

Objective 3.4 · Incident Response

Ransomware Incident Response

Objective 3.2 · Incident Response

Business Email Compromise (BEC) Response

Objective 3.2 · Incident Response

DDoS Attack Incident Response

Objective 3.2 · Incident Response

Insider Threat Investigation

Objective 3.3 · Incident Response

Supply Chain Attack Response

Objective 3.2 · Incident Response

Cloud Incident Response in AWS and Azure

Objective 3.2 · Incident Response

Digital Forensics Tools: Autopsy, FTK, Volatility

Objective 3.3 · Incident Response

Log Preservation and Chain of Custody

Objective 3.3 · Incident Response

IOC Enrichment with VirusTotal and AbuseIPDB

Objective 3.4 · Incident Response

Tabletop Exercises and IR Simulations

Objective 3.4 · Incident Response

Mobile Device Forensics and MDM Evidence

Objective 3.3 · Incident Response

Data Breach Incident Response

Objective 3.2 · Incident Response