CCNA Incident Handling Process Questions

Disconnecting the host from the network immediately stops the ransomware from reaching shared drives and other systems, limiting spread. It also preserves the host's volatile memory and running state for forensic analysis. Unlike powering off, this action maintains evidence integrity while containing the incident. It is the fastest and least destructive way to isolate the infected system during active encryption.

Rules of Engagement define the scope, authority and boundaries for containment actions, so they belong within the Incident Response Plan. Updating the IRP addresses the deficiency directly, giving responders pre-approved containment limits that prevent the accidental service disruption seen during this P1 incident.

Applying missing patches closes the vulnerability that allowed the initial compromise, preventing immediate reinfection. Eradication is not complete without addressing the root cause. Patching the system and its dependencies ensures that the same attack vector cannot be reused, and it is a critical step before restoring the system to production.

Identification is where detected events are triaged and validated to determine whether they constitute a genuine incident. This validation point is when the organization effectively 'knows' an incident exists, which is what regulators and counsel use to start notification clocks. Documenting the time of this determination inside the incident ticket provides the defensible timestamp legal needs for breach reporting.

Containment aims to limit the scope and impact of an incident. Blocking malicious communication at the firewall prevents further spread or data exfiltration, which is a classic containment action. It isolates the threat without necessarily eradicating it, aligning with the goal of stopping the incident from expanding.

The order of volatility places system memory, running processes, network connections, and other RAM-resident artifacts at the top. These are lost on shutdown or reboot, so they must be captured first. On a running Linux server, this includes process lists, open sockets, loaded modules, and memory images, all of which can reveal attacker activity not present on disk.

A cryptographic hash is a fixed-length digest derived deterministically from the file's bytes. Any alteration—even a single character—produces a completely different digest. Matching the stored known-good value therefore confirms the current file's contents are byte-for-byte identical to the verified baseline.

Legal Counsel interprets applicable statutes, privacy regulations, and contractual obligations, then advises the team on evidence handling, notification duties, and disclosure limits. This keeps containment and investigation actions within legal boundaries, satisfying the requirement that incident handling align with organisational legal and privacy requirements.

Out-of-band channels use separate infrastructure from the compromised production network, so an attacker with persistent access cannot intercept or monitor incident-response coordination. This satisfies the stem's requirement to keep team communications confidential during a major incident.

Blocking the command-and-control IP at the firewall prevents further communication from the compromised host and potentially other infected systems. This is a network-level containment measure that can be implemented quickly and does not require touching the endpoint, allowing the handler to maintain visibility while limiting the adversary's control channel.

Post-incident activity, also known as lessons learned, is the phase where the team reviews the incident to improve future response. It involves documenting the timeline, identifying the root cause, and recommending corrective actions. This phase ensures that the organization learns from the incident and updates its procedures, making it the correct phase for the described activity.

Log analysis establishes whether the traffic is malicious or benign before committing to containment or blocking, which could disrupt legitimate users. It satisfies the identification phase's need to characterise the activity, giving evidence to justify any escalation.

An IR policy grants the incident response team formal mandate, defining roles, escalation paths and decision rights. This authority framework lets responders act decisively during incidents without seeking ad hoc approval, which is its primary function.

Preparation builds the incident response capability before incidents occur: tools, communications channels, trained personnel, playbooks and authority. It establishes the resources and capabilities that later phases depend on, rather than detecting, containing or eradicating a specific incident.

Analysis determines what happened and how far the attacker reached. Scoping the compromise establishes which systems, accounts and data are affected, bounding containment and eradication work. This directly satisfies the phase's objective of understanding incident impact before remediation begins.

The communication and escalation matrix in the IR plan defines who must be notified, in what order, within what timeframe, and through which channels. Following it ensures legal, regulatory, executive, and technical stakeholders are informed appropriately. It also prevents ad hoc notifications that could leak information or violate compliance requirements. The matrix is the authoritative guide during a confirmed breach.

Open-ended questions elicit narrative accounts rather than yes/no answers, preventing the interviewer from shaping responses through suggestion or confirmation bias. This satisfies the stem's requirement for best practice during witness interviews, where uncontaminated factual recall matters most. Closed or leading questions risk distorting testimony and reducing its evidentiary value.

Post-incident activity includes reviewing the incident and documenting lessons learned. The timeline is typically finalized and analyzed here to improve future response. This phase ensures that all details are captured for reporting and legal purposes, making it the phase where documenting the timeline is a key deliverable.

Rules for communicating with law enforcement satisfy the legal and regulatory notification constraint in an incident communication plan. Breach notification statutes and sector regulators mandate specific timelines and designated points of contact, so the plan must define who contacts police, fraud units or national cybercrime agencies, and when.

Reviewing the incident timeline exposes detection gaps, such as missed alerts or delayed escalation, that allowed the incident to persist. This satisfies the Lessons Learned phase's aim of continuous improvement by producing concrete, evidence-based recommendations for tuning monitoring and response procedures.

Volatile evidence such as RAM contents, running processes, and active network connections disappears on shutdown, so capturing it before isolation preserves critical forensic value. Isolating afterward limits further exfiltration, and continued monitoring detects whether the attacker pivots or triggers destructive actions. This sequence respects the principle of order of volatility while still containing the threat, balancing investigative needs against business risk.

The Incident Coordinator owns cross-functional communication during an outbreak, liaising with legal, PR and executive leadership as NIST SP 800-61 Rev. 2 prescribes. This satisfies the stem's constraint that organisational communication follows policy, since the role centralises stakeholder messaging rather than leaving it to technical responders handling containment.

Data breach notification statutes impose legal deadlines and content requirements for informing regulators and affected parties. Integrating them into the response plan ensures incident handling meets statutory obligations, satisfying the legal considerations the question asks for.

The post-incident activity phase requires a review meeting with all involved parties to capture what worked, what failed, and what improvements are needed. Closing the incident without this review leaves root causes unaddressed and prevents the organization from improving future response. The CISO's request to close must be satisfied only after this review is documented and corrective actions are assigned.

Preparation is the phase where the organization builds everything needed before an incident happens: the response plan, communication procedures, toolkits, jump bags, and trained personnel. Developing the plan, buying forensic tools, and conducting training are all foundational preparation activities. Without this groundwork, later phases such as identification and containment are improvised, slow, and error-prone, which directly increases impact and recovery time.

Centralized authentication and SIEM correlation across all servers is the most reliable way to identify every system the compromised account touched. It captures logon events, source IPs, and timestamps across the environment, revealing lateral movement paths. Relying on a single data source is insufficient; correlating authentication logs with SIEM events provides a comprehensive scope assessment.

Stakeholder contact details let the IR team escalate and coordinate immediately during an incident, satisfying the plan's requirement for defined communication paths. Without current names and numbers, containment stalls while responders hunt for the right owner.

The incident response policy, especially the Rules of Engagement (RoE), defines the scope, authority, and constraints for incident handlers. It specifies what actions are permitted, who can authorize them, and under what conditions evidence may be collected. This document ensures that the handler's actions are legally defensible and aligned with organizational governance, making it the first reference before touching a workstation.

Stakeholder and legal counsel sign-off establishes the report as an authoritative, tamper-evident record, confirming findings were reviewed and accepted. Without that formal verification, insurers or courts may treat the document as unverified opinion rather than admissible evidence of the incident.

RAM is the most volatile evidence and is lost when the system is powered off or rebooted. Capturing memory first preserves running processes, network connections, encryption keys, and injected code that may never be written to disk. This aligns with the order of volatility and ensures critical incident artifacts are not destroyed before other collection steps.

A distributed IR team places handling capability at each geographic location while a central coordinator sets policy, standards and oversight. This matches the requirement for localised response with centralised control across a large, globally dispersed organisation, unlike centralised or coordinating structures.

Triage is the first activity in the incident handling process after detection: the analyst correlates the alert with other telemetry (proxy logs, EDR process trees, DNS logs) to confirm whether the C2 contact is real. Only after validation should the analyst classify severity and escalate. This avoids unnecessary wake-ups while still ensuring genuine incidents are escalated quickly.

A legal hold overrides routine lifecycle rules, so automatic deletion must be suspended for the affected data. This preserves potentially relevant evidence until the investigation concludes, satisfying the retention obligation without altering the wider policy.

The post-incident review, often called lessons learned, aims to evaluate the response, identify what worked and what did not, and update policies, procedures, and training. This continuous improvement is the primary purpose of the phase, ensuring the organization is better prepared for future incidents.

Chain of custody requires documented verification that evidence remained unaltered between collection, transport and storage. Tamper checks, such as sealed containers and hash validation, prove integrity, ensuring the evidence stays admissible in legal or disciplinary proceedings.

Unusual or unauthorised access patterns indicate possible compromise, such as credential misuse or lateral movement, which warrants declaring an incident so containment and investigation can begin. This satisfies the criterion of a security-relevant anomaly deviating from normal baseline behaviour.

IDS and SIEM systems continuously correlate network and host telemetry against known attack signatures and behavioural baselines, generating alerts when activity deviates. This directly satisfies the stem's requirement for a common incident identification source, since these platforms are purpose-built to surface potential security events for analyst triage.

An unbroken, documented access log proves the evidence was continuously controlled and untampered from seizure onward. This documented chain satisfies the admissibility requirement by letting the court verify integrity, defeating challenges that the device was altered or substituted.

A bit-stream image captures an exact, write-blocked replica of the storage media, preserving the original evidence intact for forensic examination and admissibility. Analysing the copy rather than the source minimises downtime on the suspect's live system while maintaining evidential integrity.

Correlation joins discrete alerts sharing entities, timelines or indicators into a single narrative, exposing the sequence of attacker actions across otherwise isolated sources. That linkage directly satisfies the stem's investigative goal: revealing attack progression rather than reviewing unrelated events individually, so analysts can reconstruct the intrusion chain.

Forensic images must remain unaltered to retain evidentiary value, so the storage must enforce write-protection preventing modification and tamper-evident logging recording any access attempt. This preserves integrity and chain of custody, satisfying the requirement that the image be admissible and verifiable.

Lessons Learned converts findings into durable change. Revising policies, procedures and controls addresses the root causes identified during the review, reducing the likelihood of the same incident recurring and satisfying the phase's forward-looking remediation objective.

Clearly defined roles and responsibilities ensure that team members know what is expected of them during an incident. This prevents confusion, avoids duplication of effort, and speeds up response. It is a fundamental component of any incident response plan, as it establishes accountability and streamlines coordination. Without it, response efforts can become chaotic, leading to delays and potential mistakes.

Real-time logging preserves the exact sequence and timestamps of containment, escalation and recovery actions while they occur. That chronological record underpins the final incident report, supports root-cause analysis, and provides defensible evidence, satisfying the stem's need for an accurate timeline.

Firewall and proxy logs contain detailed records of network connections, including source and destination IP addresses, ports, and timestamps. When aggregated in a SIEM, they enable correlation across multiple systems to identify all hosts that communicated with the C2 server. This provides a comprehensive view of the incident scope, allowing the analyst to quickly isolate other compromised endpoints. It is the most effective data source for network-based correlation during the identification phase.

Containment succeeds only if the worm stops propagating, so the rate of new successful infections measures residual spread directly. Hosts cleaned or segments isolated are outputs, but this metric captures whether the strategy actually halts transmission across the network.

The primary objective of a lessons learned meeting is to review the incident and response to identify what worked well and what needs improvement. This includes updating policies, procedures, and training to prevent similar incidents. It is a constructive, forward-looking activity that enhances the organization's resilience and response capabilities.

Normalizing to a common time zone (typically UTC) and recording each system's clock offset allows the handler to correlate events accurately and defend the timeline. This method acknowledges discrepancies and provides transparency, which is essential for forensic soundness and potential legal proceedings. It does not require altering original evidence, preserving integrity.

Data minimisation under GDPR requires limiting collection to what is adequate, relevant and necessary for the investigation. Gathering only logs and artefacts tied to the suspicious activity avoids sweeping unrelated personal data into the incident evidence set.

Customer PII breaches trigger statutory notification duties and regulatory exposure, so Legal and Privacy officers must be engaged first to assess obligations under GDPR or similar regimes and direct containment communications. They satisfy the stem's requirement to notify the correct authority before technical or PR teams act.

A detailed access log establishes an unbroken, auditable record of custody, showing who held the RAID evidence at every point and preventing gaps that would let a court challenge its integrity. This directly satisfies the admissibility requirement by proving the evidence was never tampered with.

A physical write-blocker sits between the suspect drive and the forensic workstation, blocking write commands at the hardware level so the source disk cannot be altered during imaging. This satisfies the stem's requirement to preserve evidential integrity, unlike software blockers that depend on the operating system correctly honouring them.

Containment focuses on stopping the spread of an active threat by isolating affected systems, disabling compromised accounts or blocking malicious traffic. This limits the scope and damage while preserving evidence, allowing subsequent eradication and recovery phases to proceed safely.

Escalation is driven by business impact and severity. When a critical system is affected and operations may be disrupted, management must be informed promptly to authorize resources, communicate with stakeholders, and make risk-based decisions. This aligns with the incident handling process, where escalation criteria are defined by impact, scope, and urgency rather than technical details alone.

Applying patches addresses the vulnerability that allowed the incident to occur. It is an eradication activity because it removes the root cause and prevents future exploitation. Patching is essential to ensure that the threat cannot re-enter through the same vector, thereby completing the eradication process.

Isolating a compromised host by disabling its switch port stops the attacker from moving laterally or exfiltrating additional data while preserving the system state for analysis. This is a textbook containment action because it limits damage and buys the team time. It is deliberately not a recovery step, since the system remains quarantined and unavailable to users until eradication and restoration are complete.

A timeline requires chronological sequencing, so recording detection, analysis, and containment in the order they occurred directly satisfies that constraint. This ordering lets reviewers reconstruct how quickly each phase followed the last, exposing delays between detection and containment that a thematic or severity-based grouping would obscure.

Documenting the root cause converts the incident into evidence, and defining specific, actionable process changes turns that evidence into revised procedures, runbooks and controls. Without concrete changes, the review produces observations only, so future response capability does not actually improve.

Eradication involves removing the cause of the incident, such as malware, and addressing vulnerabilities that allowed it. Applying patches and updating antivirus signatures helps eliminate the malware and prevent reinfection. This is a core eradication activity, ensuring that the threat is fully removed and the system is hardened before recovery. It directly addresses the root cause and is essential for restoring a trusted state.

Breach notification statutes impose mandatory timelines and reporting thresholds that vary by jurisdiction, so incident handlers must identify and meet each applicable requirement. This is a legal obligation, satisfying the question's call for legal considerations.

Applying a cryptographic hash (for example SHA-256) to exported logs creates a verifiable integrity baseline, proving the SIEM data has not been altered since collection. This satisfies the stem's requirement for evidence preservation, because any tampering during forensic handling becomes detectable, keeping the logs admissible and forensically sound.

Network-level isolation stops lateral spread and re-infection communications while the host remains live for memory capture and persistence hunting. Examining autostart, scheduled task, and service locations identifies how the ransomware re-establishes itself. This satisfies containment by limiting impact without destroying the evidence needed to find the root cause, and it keeps the option of full eradication once the mechanism is understood.

WORM media physically prevents modification or deletion after writing, directly satisfying the evidence-integrity requirement for long-term investigation log retention. Unlike standard storage, where administrators or attackers could alter records, WORM enforces immutability at the hardware or firmware level, preserving forensic admissibility across the entire retention period.

Severity reflects consequence, so business availability and data integrity weigh heaviest: they determine operational and regulatory harm. Detection source or attacker identity says little about actual damage, making impact the decisive axis for prioritising response.

Encrypting the transfer channel prevents interception or tampering in transit, while destination-side hash verification confirms the copy matches the source bit-for-bit. Together they preserve evidence integrity and chain of custody across the network, which the remote scenario demands.

A current contact list for internal and external stakeholders is essential because the plan's notification and escalation duties depend on reaching the right parties quickly. Without accurate details, escalation paths stall and regulatory or customer notifications breach mandated timelines, directly undermining the communication plan's purpose during an incident.

Human Resources participates in IR teams because incidents often involve insider threats, employee misconduct or disciplinary and legal consequences. HR advises on privacy, employment law and staff communications, satisfying the stem's expectation that a typical IR team spans technical, legal and organisational functions rather than engineers alone.

A playbook provides specific, repeatable steps for handling a defined incident type.

MTTD measures elapsed time between an incident's occurrence and its detection. Without documented Time of Occurrence and Time of Detection, that interval cannot be calculated, so the metric is directly undermined. Other metrics, such as MTTR, depend on response and recovery timestamps instead.