A+ Incident Response and Chain of Custody Basics

1. What should be done immediately after discovering a security incident?

Begin system repairs

Document initial observations and stop further changes

Delete suspicious files

Reboot all systems

Submit

3. What should be included in an incident response plan?

Contact information and escalation procedures

Evidence handling protocols

Communication procedures

All of the above

4. Which documentation is essential for maintaining chain of custody?

Only incident summaries

Detailed logs of who accessed evidence, when, and why

Only photographs

Only witness statements

5. True or False: All team members involved in incident response require the same level of access to evidence.

True

False

Submit

7. What is the purpose of the 'recovery' phase in incident response?

To document the incident for legal proceedings

To restore systems to normal operations

To identify the attacker

To notify affected customers

8. Which of the following violates chain of custody integrity?

Documenting all transfers with timestamps

Allowing unauthorized personnel to access evidence

Storing evidence in locked containers

Creating detailed inventory records

9. True or False: Incident response procedures should be tested and updated regularly.

True

False

Submit

11. What is the primary purpose of maintaining a chain of custody in incident response?

To document who handled evidence and when

To accelerate the investigation process

To reduce investigation costs

To determine guilt or innocence

12. Which phase of incident response involves investigating how the breach occurred?

Containment

Eradication

Investigation and analysis

Recovery

13. What is the primary advantage of creating forensic images of compromised systems?

To reduce system performance impact

To preserve original evidence without alteration

To speed up the investigation

To reduce storage costs

14. True or False: It is acceptable to modify system files during evidence collection if it helps the investigation.

True

False

Submit

16. Which of the following is a critical component of proper evidence preservation?

Making copies of all evidence immediately

Preventing unauthorized access and maintaining integrity

Storing evidence in standard office folders

Sharing evidence with multiple team members

17. What information must be recorded when evidence is transferred between handlers?

Only the time of transfer

Handler names, dates, times, and reason for transfer

Only the handler's department

Only digital signatures

18. True or False: Chain of custody documentation is only necessary for criminal investigations.

True

False

19. In incident response, what does 'containment' primarily refer to?

Storing evidence in secure containers

Limiting the spread of a security breach

Documenting all system logs

Notifying law enforcement

20. Which step should be performed first when responding to a security incident?

Isolate affected systems

Preserve evidence and document the scene

Notify management and stakeholders

Begin immediate remediation

A+ Incident Response and Chain of Custody Basics Quiz

1. What should be done immediately after discovering a security incident?

2.

What first name or nickname would you like us to use?

2. In incident response, 'detection' primarily involves ____.

3. What should be included in an incident response plan?

4. Which documentation is essential for maintaining chain of custody?

5. True or False: All team members involved in incident response require the same level of access to evidence.

6. During evidence handling, 'integrity' means ____.

7. What is the purpose of the 'recovery' phase in incident response?

8. Which of the following violates chain of custody integrity?

9. True or False: Incident response procedures should be tested and updated regularly.

10. In chain of custody, a 'seal' typically refers to ____.

11. What is the primary purpose of maintaining a chain of custody in incident response?

12. Which phase of incident response involves investigating how the breach occurred?

13. What is the primary advantage of creating forensic images of compromised systems?

14. True or False: It is acceptable to modify system files during evidence collection if it helps the investigation.

15. During incident response, 'eradication' refers to ____.

16. Which of the following is a critical component of proper evidence preservation?

17. What information must be recorded when evidence is transferred between handlers?

18. True or False: Chain of custody documentation is only necessary for criminal investigations.

19. In incident response, what does 'containment' primarily refer to?

20. Which step should be performed first when responding to a security incident?