Incident Handling Process

During the containment phase of a ransomware incident, you must decide whether to disconnect the infected host from the network or keep it connected for monitoring. The host is encrypting files on a shared network drive. Which action should you take FIRST to limit the spread while preserving evidence?

During the lessons learned phase of a P1 incident, you notice that the incident handling policy failed to define clear 'Rules of Engagement' for containment, leading to accidental service disruption. Which document should be updated to address this deficiency?

You are leading the eradication phase of a malware incident. Which TWO activities are essential to ensure the malware is completely removed and the system is restored to a trusted state? (Choose two.)

A handler is documenting a confirmed breach of a customer database. Legal counsel needs to know the earliest point at which the organization 'knew' the incident occurred for regulatory reporting deadlines. During which phase of the incident handling process does this formal determination of incident occurrence typically get made?

During an incident, a security analyst discovers that a compromised workstation is communicating with a known malicious IP address. The analyst wants to block the IP at the perimeter firewall. Which phase of the incident handling process does this action fall under?

An incident handler is preparing to collect volatile evidence from a compromised Linux server that is still running. The handler must decide which data to capture first before memory-resident artifacts are lost. Which of the following should be collected FIRST?

During an investigation, you need to verify the integrity of a system configuration file. You have the original known-good hash. What does it mean if the hash of the current file matches the known-good hash?

Which role in the Incident Response Team is primarily responsible for ensuring that the incident handling activities remain aligned with organizational legal and privacy requirements?

You are setting up a secure communication channel for the IR team during a major incident. Why is it recommended to use an out-of-band communication method?

An incident handler is preparing the containment strategy for a compromised workstation that is communicating with a command-and-control server. Which TWO actions are appropriate immediate containment measures? (Choose two.)

An organization is conducting a post-incident review after a major data breach. The team must document the incident timeline, root cause, and corrective actions. Which phase of the incident handling process does this activity belong to?

During the identification phase, you notice a high volume of traffic from an unknown IP to your web server. What is the most appropriate action to take first?

What is the primary function of an Incident Response (IR) policy?

What is the primary purpose of the 'Preparation' phase in the incident response lifecycle?

Which TWO of the following actions are standard steps in the 'Analysis' phase of an incident?

An organization's incident response plan defines a communication protocol for notifying stakeholders during an incident. A major security breach has just been confirmed, and the incident handler must decide who to notify and how. Which of the following is the PRIMARY factor that should guide the notification process?

When conducting an interview with a potential witness during an investigation, what is the best practice to follow?

A security analyst is documenting an incident that involved unauthorized access to a database. The analyst needs to record the timeline of events. Which phase of the incident handling process includes documenting the timeline?

Which THREE of the following should be included in an incident communication plan?

When managing the 'Lessons Learned' phase of the incident response lifecycle, which THREE activities should be conducted to ensure continuous improvement?

During a live intrusion, the incident commander must choose a containment strategy. Taking the affected system offline immediately would destroy volatile memory evidence and alert the attacker, while leaving it online risks further data exfiltration. Which approach best balances evidence preservation with damage limitation?

You are utilizing NIST SP 800-61 Rev. 2 to structure your incident response team. During a critical ransomware outbreak, you need to assign a lead who coordinates with legal, PR, and executive leadership. Which role should you designate to ensure organizational communication is handled per the policy?

Which TWO of the following are considered 'Legal Considerations' during the Incident Handling process that must be integrated into the response plan?

A hospital's incident response team has just finished eradicating a ransomware infection that encrypted several clinical workstations. The CISO asks the handler to formally close the incident and release the team. According to the incident handling process, which activity must occur BEFORE the incident can be declared closed?

An organization's incident response team is drafting its first formal incident handling capability. Management asks which phase of the process should include developing the incident response plan, acquiring forensic tools, and training the team before any real event occurs.

During an incident investigation, the handler discovers that an attacker used a compromised service account to move laterally across multiple servers. The handler needs to determine the full scope of affected systems. Which of the following is the MOST reliable method to identify all systems the attacker accessed using that account?

Which TWO of the following are essential components of an effective Incident Response (IR) plan?

You are an incident handler assigned to a case involving a suspected insider threat. Before collecting evidence from an employee's workstation, you must ensure your actions are legally defensible and compliant with company policy. Which document should you consult FIRST to determine your authority to search and seize the workstation?

You are preparing a final report for an incident. Which element is mandatory for ensuring the report serves as a valid document for future insurance or legal claims?

During a live incident, an analyst needs to capture volatile data from a compromised Windows server before containment. The server has 32 GB of RAM and is still running. Which action should the analyst perform FIRST to preserve the most volatile evidence?

An organization is establishing an Incident Response (IR) team. According to NIST, which team structure is most suitable for a large, globally distributed organization that requires localized response capability with centralized oversight?

A junior SOC analyst receives an alert at 03:00 showing a workstation contacting a known command-and-control (C2) IP address. The analyst is unsure whether this is a true incident or a false positive and wants guidance before waking the on-call incident handler. According to the incident handling process, what should the analyst do FIRST?

You are dealing with a legal hold request for data related to an investigation. How should you handle the data retention policy for this specific case?

After an incident has been resolved, the incident handler is conducting a post-incident review. Which activity is the PRIMARY purpose of this phase?

Which THREE of the following are critical requirements for maintaining a valid Chain of Custody?

Which TWO of the following are common indicators that an incident should be declared?

Which TWO of the following are common sources for incident identification?

You are managing chain of custody for a physical server seized during an investigation. What is the most critical action to ensure the evidence remains admissible in court?

You suspect an incident involves an insider threat. Which step should be taken FIRST to preserve the integrity of the potential evidence while minimizing system downtime?

You are using a SIEM to correlate events during an investigation. What is the primary advantage of correlation in incident analysis?

You are choosing a destination for forensic image storage. What is the most critical characteristic of this storage?

Which TWO of the following are primary objectives of the 'Lessons Learned' phase?

During the preparation phase, an organization is developing its incident response plan. Which TWO of the following are essential elements that should be included to ensure effective incident handling? (Choose two.)

During an incident, why is it important to keep the 'Incident Log' updated in real-time?

A security analyst receives an alert about a possible data exfiltration from a compromised workstation. The analyst needs to determine the scope of the incident by identifying other systems that may have communicated with the same command-and-control (C2) server. Which data source is most effective for this correlation during the identification phase?

You are assessing the effectiveness of a containment strategy for a worm spreading through the network. What is the most effective metric to use?

After a major security breach, you are tasked with conducting a lessons learned meeting. Which of the following is the PRIMARY objective of this meeting?

An incident handler is documenting the timeline of a security breach. The handler discovers that system clocks on different servers are not synchronized. Which action should the handler take to ensure the timeline is accurate and defensible?

You are performing an incident investigation involving a suspected insider threat. Under GDPR compliance, you must ensure that your data collection methods adhere to the 'data minimization' principle. Which action best aligns with this requirement?

Which team should be notified first in the event of a confirmed external data breach involving customer PII?

While investigating a server compromise, you need to ensure the digital evidence collected from the RAID array is admissible in court. What is the most critical requirement for the chain of custody?

Which TWO of the following are recommended when creating a forensic copy of a hard drive?

An incident handler is reviewing an alert from the Endpoint Detection and Response (EDR) system. What is the main goal of the 'Containment' phase?

An organization's CSIRT is activated for a suspected ransomware outbreak. The incident handler must decide whether to escalate the incident to management. According to the incident handling process, which factor is the MOST appropriate trigger for immediate escalation?

A security team is reviewing their incident handling process after a recent data breach. They want to ensure that their eradication phase is effective. Which TWO activities are essential during the eradication phase? (Choose two.)

A financial services firm has activated its incident response plan after detecting unauthorized access to an internal file server. The incident commander must decide which activities belong to the containment phase rather than recovery. (Choose two.)

You are documenting a post-incident review. Which of the following should be included in the 'Timeline of Events' section?

You are performing a post-incident review. Which action is the most important to ensure that the 'Lessons Learned' process effectively improves future response capabilities?

After containing a malware incident, the incident response team needs to remove the malware from infected systems and restore them to a trusted state. Which activity is part of the eradication phase?

Which THREE of the following are legal considerations when handling an incident?

You have identified a potential Advanced Persistent Threat (APT) in your network. Which evidence preservation strategy is required to maintain the validity of the logs found in a SIEM?

A healthcare provider's incident response team is notified that a clinical workstation is repeatedly re-infecting with ransomware 20 minutes after each cleanup. Volatile evidence has been preserved, and the business owner has authorized taking the endpoint offline. The team suspects a persistent mechanism that re-establishes the payload. Which action BEST aligns with the Containment phase of the incident handling process while preserving the ability to identify the persistence mechanism?

You are configuring a SIEM for long-term storage of investigation logs. Which feature is most important to prevent evidence tampering?

When classifying the severity of an incident, which factor should carry the most weight in your decision-making process?

When dealing with digital evidence in a remote investigation, what is the standard procedure to ensure evidence integrity during network transfer?

Which TWO of the following are essential components of an effective Incident Communication Plan?

Which THREE of the following roles are typically included in an IR team?

You are establishing an Incident Response Plan (IRP). Which document should prioritize the technical steps for restoring services after a ransomware attack?

You are reviewing a failed incident case management report. The team failed to capture the 'Time of Detection' vs. 'Time of Occurrence'. Which metric is directly impacted by this lack of documentation?