The incident response process, step by step

Key: C

1. AArchiving evidence is a records task that keeps material for legal or later use; it is not a meeting to reflect on the incident and plan improvements.
2. BUpdating the disaster recovery plan may be one outcome of the review, but it is a document change, not the session itself.
3. CCorrect: A post-incident review (lessons-learned meeting) right after the incident looks at what happened and what worked, and turns that into action items.
4. DRevising the incident response policy can come out of the review, but it is a follow-up action instead of the reflection session the stem describes.

Key: C

1. AWriting a new security policy may come out of the review, but drafting it first skips the step that tells you what the policy should change.
2. BA company-wide notice is a communication decision made under the communication plan; it is not the next phase once recovery is complete.
3. CCorrect: Once containment, eradication and recovery are done, the post-incident step is a lessons-learned review that captures root cause and improvements.
4. DAsking for new funding may follow from the findings, but without the lessons-learned review there is no evidence for what the money should buy.

Key: C

1. AHow long an investigation might take affects scheduling, but a quick case on a minor system should never jump ahead of a serious one.
2. BWhere an attack appears to come from is easy to fake and says little about how much harm the incident can do.
3. CCorrect: Triage ranks incidents by what is at stake: how critical the affected systems are, how sensitive the data is, and what the operational damage could be.
4. DA sophisticated technique is interesting to analysts, yet a simple attack on a critical system can matter far more.

Key: B

1. AHanding the plan to every employee spreads awareness, yet it never shows whether the plan works under pressure.
2. BCorrect: A simulated incident, such as a tabletop or a functional exercise, puts people through the plan and exposes gaps before a real incident does.
3. CAn annual read-through keeps the document current, but reading a plan does not test how the team carries it out.
4. DNew tools may help detection, but buying them tests nothing about the response plan itself.

Key: A

1. ACorrect: Containment comes first once a breach is confirmed, because it stops further unauthorized access and limits the damage while the investigation continues.
2. BCustomer notification follows the communication plan and legal advice once the scope is known; doing it before containment leaves the breach active.
3. CA full system audit is a slow, broad review that belongs to analysis and post-incident work, too late for the immediate response to an active breach.
4. DThe cause was a software vulnerability, so replacing hardware does not address it and would also destroy evidence.

Key: A

1. ACorrect: Blocking the attacking source IPs at the firewall or WAF is fast, targeted containment that stops the attack while the team investigates.
2. BRebuilding the server is eradication and recovery work; doing it first destroys evidence and takes the application down without knowing the scope.
3. CTaking the whole network offline is far out of proportion to one web application attack and causes more disruption than the attack itself.
4. DDisabling every user account locks out legitimate users and does nothing about attack traffic coming from outside.

Key: D

1. ANotifying customers is a later, legally driven step; it does not stop data from leaving and comes after the scope of the loss is known.
2. BRebuilding servers is eradication or recovery work that destroys evidence and does not stop data that is leaving over an active channel.
3. CCutting off every employee is disruptive and unfocused, and it fails if the exfiltration runs over an attacker-controlled channel rather than an employee account.
4. DCorrect: Finding and blocking the channel the data is leaving through (a connection, protocol, service or account) is the containment step that stops further loss.

Key: B

1. ABlocking known C2 IPs alone is easy to get around, because malware often switches to other addresses or domains, so the infected hosts stay under attacker control.
2. BCorrect: With active C2 and an incomplete scope, isolating the affected hosts cuts the attacker off right away and keeps evidence on the hosts for analysis.
3. CReimaging before containment and scoping destroys evidence and can miss other infected hosts that are still calling out.
4. DEradication across the whole network before the scope is known is premature; you cannot reliably remove what you have not yet found.

Key: B

1. AResetting admin credentials and patching are needed after a pass-the-hash compromise, but they are eradication steps, and the active foothold on both hosts must be contained first.
2. BCorrect: Isolating WKS-01 and SRV-02 stops the attacker moving further from both compromised hosts and keeps them intact for forensics.
3. CMemory images are valuable evidence, but capturing them on every host takes time and does not stop the movement that is happening now.
4. DRebuilding from backups is recovery work; doing it now destroys evidence and leaves other footholds unknown.

Key: A

1. ACorrect: EDR isolation of the affected hosts plus tighter ACLs on that VLAN stops the spread while the rest of the network keeps working.
2. BBlocking all outbound traffic hurts the whole business and does not stop movement inside the network, which is what is spreading the ransomware.
3. CWaiting for legal approval lets the ransomware keep spreading; routine containment is normally pre-authorized in the incident response plan and playbooks.
4. DCutting all inter-VLAN routing is broader than needed when the compromise is confined to one VLAN, and it disrupts every other segment.

Key: D

1. AShutting the server down stops the critical business applications and wipes volatile evidence such as memory.
2. BRebuilding right away is an eradication and recovery step; doing it before scoping destroys evidence and may reinstall the same weakness.
3. CCutting the server off the network completely stops the attacker, but it also takes down the critical applications the business depends on.
4. DCorrect: logical containment uses network controls such as ACLs, firewall rules and segmentation to block the attacker's paths while the server keeps serving the business.

Key: B

1. ASegmenting the file server is a longer-term architecture change; it does not cancel the stolen credentials that the attacker is already using from somewhere else.
2. BCorrect: The attacker kept reaching the file share after the workstation was isolated, which means they had the user's credentials or session, so resetting those and revoking active sessions was the missing step.
3. CBlocking inbound connections at the perimeter does not stop an attacker who is already authenticated inside with valid credentials, and exfiltration usually goes outbound.
4. DUpdating EDR signatures helps detect known malware, but it does nothing about an attacker logging in with a stolen identity.

Key: A

1. ACorrect: Restoring from clean, offline backups is the most reliable recovery, because backups kept off the network during the attack should not be encrypted.
2. BRebuilding everything from scratch takes far longer than restoring from backups and is only a fallback when no clean backups exist.
3. CPaying the ransom gives no guarantee of a working decryptor, funds the attacker and may carry legal sanctions risk, so it is not a first choice.
4. DBreaking modern ransomware encryption is not practical; free decryptors exist only for some families with known flaws, so this is not a first step.

Key: D

1. AEDR has already isolated the workstation, so pulling its switch cable adds nothing; the open question is which other hosts are involved.
2. BNotifying all executives at this point is premature; escalation follows the communication plan once the severity and scope are understood.
3. CReimaging is eradication; doing it before scoping destroys evidence and can leave persistence on other hosts untouched.
4. DCorrect: With the first host already isolated, triage sets the scope (for example, checking for lateral movement) so the containment playbook covers every affected host instead of only the first one found.

Key: A

1. ACorrect: Bringing every employee into the analysis is not recommended; it spreads sensitive details, risks tipping off an insider and makes it easier to mishandle evidence.
2. BTelling key stakeholders early, through the communication plan, is a normal part of the first analysis.
3. CWorking out the scope of the incident is a central goal of the analysis step.
4. DCollecting and preserving evidence early, with chain of custody, protects it for root-cause work and any legal action.

Key: A

1. ACorrect: Working out how far the breach reaches and what it could cost the organization is assessing the scope of impact.
2. BRTO (recovery time objective) is a continuity target for how long a system can be down; it is not about how far a breach spread.
3. CData integrity is about whether data was changed, which is only one part of the impact the analyst is assessing.
4. DDowntime measures how long a service is unavailable, which is narrower than the overall reach and consequences of a breach.

Key: C

1. ANetwork configuration may change after an incident, but it does not capture how the team should respond next time.
2. BAsset inventories support response, yet they record what you own rather than the steps for handling this attack type.
3. CCorrect: Lessons learned feed back into the incident response playbooks, so the next attack of the same kind is handled faster and more consistently.
4. DFirewall rules may be tightened as a fix, but they do not carry the response procedure forward.