6 Incident Response Free Online FlashCards

What is incident response?

Incident response is the coordinated process of recognizing, managing, and recovering from a cybersecurity incident while limiting harm to people, systems, information, and operations.

What is the purpose of incident-response preparation?

Preparation defines incident criteria, reporting routes, roles, escalation paths, procedures, and resources before an incident occurs.

Why does an alert need triage?

An alert is not automatically a confirmed incident. Triage assesses whether it is credible, meets incident criteria, how serious it may be, and what action is needed first.

What should an incident record capture?

Record observations, decisions, actions, timestamps, responsible people, and the basis for important conclusions. Preserve relevant evidence and restrict access to it.

What is the goal of containment?

Containment limits damage and prevents an incident from spreading while responders investigate.

What trade-off should responders consider when containing an incident?

Containment can interrupt essential services. Choose actions with operational impact in mind, record what changed and why, and do not delay urgent steps needed to protect people or limit serious harm.

What does eradication accomplish?

Eradication removes the attacker’s access and the underlying causes or artifacts of the compromise, such as malicious software, exploited weaknesses, or exposed credentials.

What checks should precede returning restored systems to normal use?

Restore from known-good sources, verify weaknesses are addressed, and test that systems work as expected before returning them to normal use.

What does an after-action review examine?

An after-action review identifies what happened, what worked, what caused delays or confusion, and what should change.

How can new evidence change incident response?

Triage and other response stages are iterative: new evidence can change the incident’s scope or priority and send responders back to analysis, containment, or eradication.

What questions guide an initial incident assessment?

Assess what happened and when, what may be affected, severity and urgency, available evidence, and who must be involved or notified.

Name two possible containment actions.

Responders might isolate an affected device, restrict a compromised account, block malicious traffic, or temporarily take a vulnerable service offline.