CoreQ Academy4.8 Explain appropriate incident response activities.
Incidents will happen. A prepared team that follows a clear process limits damage, preserves evidence and learns from every event.
Process
- Preparation
- Plans, tools, contacts, training and logging in place before anything happens.
- Detection
- Identifying that an incident may be occurring from alerts, reports or anomalies.
- Analysis
- Confirming the incident, scoping it and determining severity.
- Containment
- Stopping the spread: isolate hosts, disable accounts, block IPs.
- Eradication
- Removing the cause: malware, attacker accounts, vulnerabilities exploited.
- Recovery
- Restoring systems to normal operation and monitoring closely.
- Lessons learned
- A post-incident review to improve controls and the plan.
Training and testing
- Training
- Making sure responders and staff know their roles.
- Tabletop exercise
- Discussion-based scenario walk-through.
- Simulation
- Hands-on practice of a realistic incident.
Analysis activities
- Root cause analysis
- Finding the underlying reason the incident happened, not just the symptom.
- Threat hunting
- Proactively searching for hidden threats that evaded detection, guided by hypotheses and intelligence.
Digital forensics
- Legal hold
- An instruction to preserve all relevant data because of expected litigation; normal deletion stops.
- Chain of custody
- Documentation of who handled evidence, when and why, proving it was not tampered with.
- Acquisition
- Collecting evidence in a forensically sound way, following order of volatility (memory before disk) and using write blockers and hashes.
- Reporting
- Documenting findings clearly for technical, management and legal audiences.
- Preservation
- Keeping evidence intact and secure, working on copies not originals.
- E-discovery
- Identifying and producing electronic information for legal proceedings.
Check your understanding
Knowledge quiz · pass mark 80%
- Isolating an infected laptop from the network is which phase?
- Which document proves evidence has not been tampered with since collection?
- Proactively searching for attackers that did not trigger alerts is:
- System memory should usually be captured before the hard disk.
- Put the incident response phases in order.
- Detection
- Containment
- Recovery
- Lessons learned
- Eradication
- Analysis
- Preparation
Original CoreQ Academy material, mapped to objective 4.8 of the publicly available CompTIA Security+ SY0-701 exam objectives (Exam objectives V7, document version 7.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.