Security Incident Response & Management Flashcards
7 cards from real CSPM practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Security Incident Response & Management flashcards as text
According to NIST SP 800-61, what is the correct order of the incident response lifecycle phases?
Answer: Preparation, Detection & Analysis, Containment/Eradication/Recovery, Post-Incident Activity
NIST SP 800-61 defines four phases: Preparation; Detection & Analysis; Containment, Eradication & Recovery; and Post-Incident Activity.
What document formally defines the scope, authority, and responsibilities of an incident response team?
Answer: Incident Response Plan
The Incident Response Plan (IRP) formally defines the team's scope, authority, communication procedures, and step-by-step response procedures.
A security project manager discovers a breach mid-project. What should be the FIRST action taken?
Answer: Activate the incident response plan
Activating the incident response plan ensures a structured, coordinated approach to handling the breach from the outset.
What is the primary purpose of 'containment' during incident response?
Answer: To limit the damage and prevent the incident from spreading
Containment's primary goal is to stop further damage by limiting the incident's spread while preserving evidence for analysis.
What does 'chain of custody' ensure in a security incident investigation?
Answer: That evidence is properly collected, documented, and protected from tampering
Chain of custody documents who handled evidence, when, and how, ensuring its integrity and admissibility in legal proceedings.
Which incident response team structure consists of security professionals across departments who fulfill IR duties in addition to their normal roles?
Answer: Virtual Incident Response Team
A Virtual Incident Response Team is composed of members with other primary roles who are activated as needed when an incident occurs.
What is the primary objective of the 'Post-Incident Activity' phase in NIST's incident response lifecycle?
Answer: To document lessons learned and improve future response capabilities
Post-Incident Activity focuses on conducting a lessons-learned review to identify improvements in people, processes, and technology for future incidents.
How this page was made: written with AI tools and published by Nathan Beja, founder of Practice Test Geeks, who is responsible for its content. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy
Sources & references
Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy
- securityindustry.org — Test delivery, fees, passing score, retake policy, score release, test dates, time limit, score validity, renewal · verified Oct 2026