Incident Response Process

Question 1

What is an Incident?

Answer 1

Act of violating a security policy

Question 2

What is the 1st step of Incident Response - Preparation?

Answer 2

Involves hardening systems and networks to resist attacks

Question 3

What is the 2nd step of Incident Response - Detection?

Answer 3

Identifies a security incident

Question 4

What is the 3rd step of Indcident Response - Analysis?

Answer 4

Thoroughly examines and evaluates the incident

Question 5

What is the 4th step of Incident Response - Containment?

Answer 5

Prevents the incident from spreading by securing data and minimizing business impact

Question 6

What is the 5th step of Incident Response - Eradication?

Answer 6

Focuses on removing malicious activity from systems or networks

Question 7

What is the 6th step of Incident Response - Recovery?

Answer 7

Restores affected systems and services to their secure state

Question 8

What is the 7th step of Incident Response - Post-Incident Activity?

Answer 8

Identifies the initial incident source and makes improvements to prevent future incidents

Question 9

What is the Lessons Learned Process?

Answer 9

Documents experiences during incidents in a formalized way

Question 10

What does an After-action report do?

Answer 10

Collects formalized information about what occurred