4.8 - The incident response process
Security+ SY0-701 objective 4.8 covers the incident response lifecycle and its order. The phases are preparation; detection and analysis; containment; eradication and recovery; and post-incident lessons learned. Immediately after detecting and analysing an incident, you contain it to stop the spread - during a live intrusion, the first priority action after confirming the incident is to contain and isolate affected hosts. Eradication then removes the threat and closes the exploited vulnerability, and recovery restores systems to normal. To validate the plan without a real incident, a tabletop exercise walks a team through a scenario in a meeting. You should also know digital forensics, chain of custody, and root-cause analysis. Expect scenario questions that give a moment in an incident and ask which phase or first action - contain, eradicate, recover or a tabletop test - applies.
Order: prepare, detect/analyse, CONTAIN, eradicate + recover, lessons learned. Right after detection = contain/isolate hosts. Remove threat + close the hole = eradication. Practice the plan in a meeting = tabletop exercise.
Practice questions
1. In incident response, what should you do immediately after detecting and analyzing an incident?
- Delete all the relevant logs
- Contain it to stop the spread (correct answer)
- Ignore it until much later
- Publicly disclose it right away
NIST order: Preparation → Detection & Analysis → Containment, Eradication & Recovery → Post-incident. Contain first to limit damage; preserve evidence.
2. During incident response, which step aims to remove the threat and restore systems to a known-good state?
- Preparation phase
- Detection and analysis
- Eradication and recovery (correct answer)
- Lessons-learned review
Eradication removes malware/artifacts and closes the entry point; recovery restores systems from clean backups/images and validates them before returning to service.
3. To validate the incident-response plan by walking through a scenario in a meeting without touching systems, run a:
- A full failover test
- A tabletop exercise (correct answer)
- A live penetration test
- A production restore
A tabletop exercise discussion-tests the plan and roles without impacting systems. Failover/parallel tests actually switch to backups; both validate readiness differently.
4. During a live intrusion, the FIRST priority action after confirming the incident is to:
- Write the final report
- Notify the press quickly
- Contain and isolate affected hosts (correct answer)
- Rebuild every server at once
After detection/analysis, contain to stop spread (isolate hosts, block accounts) while preserving evidence, then eradicate and recover. Reporting and rebuilds come later.
5. After recovering from an incident, which step turns the experience into improved future defenses?
- Immediately deleting all logs
- Skipping any documentation
- A lessons-learned review (correct answer)
- Publicly blaming an employee
The post-incident (lessons-learned) review analyzes what happened and updates controls, playbooks and training — closing the loop so similar incidents are prevented or handled better.
6. An analyst reviewing an incident wants signs that a host was compromised. A 'new unknown scheduled task' is an example of a:
- A network indicator
- A host-based indicator (correct answer)
- A physical indicator
- A financial indicator
Host-based indicators appear on the endpoint (new tasks/services, unusual processes, changed files, registry keys). Network indicators appear in traffic (odd connections, beaconing, DNS).