Security+
CompTIA Security+ SY0-801 / All lessons / Domain 4.0: Security Operations
4Domain 4.0: Security Operations
Security+ topic 4.7

Incident Response

An incident response plan tells everyone what to do when an attack happens. The process runs through preparation, detection, analysis, containment, eradication, recovery, and lessons learned. Containment stops the damage from spreading, for example by isolating a host. Eradication removes the cause, recovery returns systems to normal, and lessons learned improves the plan. Teams practice with tabletop exercises and simulations, and use threat hunting to look for attackers before an alert fires. Root cause analysis finds the real reason an incident happened so it does not happen again.

Picture itPrepareDetectAnalyzeContainEradicateRecoverLessonsimprove the plan
The incident response process. Lessons learned feeds back into preparation.

Incident Response vocabulary

  • Containment: Limiting an incident so it cannot spread, for example by isolating an infected host.
  • Eradication: Removing the cause of an incident, such as malware or a compromised account.
  • Lessons learned: The final review after an incident that improves future response.
  • Threat hunting: Actively searching for hidden attackers instead of waiting for an alert.

Exam-style practice questions

Try each one, then open the answer. To save your progress, take this quiz in the interactive course.

1. An analyst confirms ransomware on one workstation and disconnects it from the network. Which phase of incident response is this?

  1. (A) Preparation
  2. (B) Containment
  3. (C) Recovery
  4. (D) Lessons learned
Show answer

(B) Containment Isolating the host stops the spread, which is containment.

2. After an incident is resolved, the team meets to discuss what went well and what to improve. Which phase is this?

  1. (A) Lessons learned
  2. (B) Detection
  3. (C) Eradication
  4. (D) Analysis
Show answer

(A) Lessons learned The review after an incident is lessons learned.

3. Analysts search the network for signs of an attacker that no alert has detected. Which of the following is this?

  1. (A) Threat hunting
  2. (B) Change management
  3. (C) Asset tagging
  4. (D) Load balancing
Show answer

(A) Threat hunting Proactively searching for hidden threats is threat hunting.

4. Which of the following should happen before an incident occurs?

  1. (A) Eradication
  2. (B) Preparation, such as writing the plan and training the team
  3. (C) Recovery
  4. (D) Root cause analysis
Show answer

(B) Preparation, such as writing the plan and training the team Preparation comes first so the team is ready.

Open 4.7 in the interactive course