What is the first step in incident response?

Question

Accepted Answer

Identifying and confirming the incident

Answer

The first and most critical step in incident response is to accurately identify and confirm that an actual security incident has occurred. This involves detecting anomalies, gathering initial evidence, and verifying the nature and scope of the potential breach. Without proper identification, an organization cannot effectively contain, eradicate, or recover from the incident, making this foundational for all subsequent response activities.

(CREST) Council for Registered Ethical Security Testers Practice Test

(CREST) Council for Registered Ethical Security Testers Practice Test

CREST Incident Response & Forensic Analysis 1