Incident Response Flashcards
7 cards from real ISC2 CC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Incident Response flashcards as text
What is the goal of the Eradication phase in incident response?
Answer: Removing the root cause and malicious artifacts from affected systems
The Eradication phase focuses on removing malware, closing exploited vulnerabilities, and eliminating the root cause of the incident.
'Lessons learned' activities primarily occur during which phase of the incident response lifecycle?
Answer: Post-Incident Activity
Post-Incident Activity includes conducting lessons learned meetings to evaluate the response, improve processes, and update documentation for future incidents.
Which of the following BEST represents a security incident?
Answer: Unauthorized access to sensitive customer records
Unauthorized access to sensitive customer records is an actual security incident because it violates the confidentiality of protected information without authorization.
What term describes prioritizing security incidents based on their severity and potential impact?
Answer: Triage
Triage is the process of evaluating and prioritizing incidents based on their potential impact and urgency so the most critical issues are addressed first.
Which of the following BEST describes the Recovery phase of incident response?
Answer: Restoring affected systems to normal and verified operation
The Recovery phase involves restoring affected systems to full, verified operational status after the incident has been contained and eradicated.
What is the purpose of maintaining a chain of custody during incident response?
Answer: To track evidence handling and preserve its integrity for legal proceedings
Chain of custody documents the handling, transfer, and storage of evidence to ensure its integrity and admissibility in legal or disciplinary proceedings.
Which type of incident response team is a full-time, permanently established team within an organization?
Answer: Dedicated CSIRT
A Dedicated (Permanent) CSIRT is a full-time team with incident response as its primary mission, always available within the organization.