Incident Response (Security+) Quiz: 6-Step Framework

1. True or False: An incident response plan should be tested only after a real incident occurs.

True

False

Submit

3. Which phase involves restoring systems to their normal operational state?

Containment

Eradication

Recovery

Detection

4. True or False: The incident response process is linear and does not involve iteration.

True

False

Submit

6. Which containment strategy involves creating a copy of a system for analysis without affecting production?

Isolation

Segmentation

Snapshots

Backup

7. True or False: During eradication, it is acceptable to simply restart compromised systems without removing malware.

True

False

8. Which of the following is a key component of incident response preparation?

Purchasing new hardware

Developing an incident response plan and training

Waiting for incidents to occur

Eliminating all security risks

Submit

10. Which communication channel is typically used to notify stakeholders during an active incident?

Public social media

Secure, pre-established notification system

Email to all company contacts

Text messages only

11. Which phase of incident response focuses on establishing tools, policies, and training before an incident occurs?

Preparation

Detection

Containment

Recovery

Submit

13. What is the primary purpose of evidence preservation during incident response?

Ensure legal admissibility and forensic integrity

Prevent future attacks

Speed up system recovery

Reduce incident cost

14. Which post-incident activity involves reviewing what happened and how to improve?

Root cause analysis

System restoration

Threat hunting

Evidence collection

15. True or False: The recovery phase includes removing malware and patching vulnerabilities.

True

False

Submit

17. Which role is responsible for making critical decisions during an incident response?

Incident responder

Incident commander

Security analyst

System administrator

18. In the eradication phase, what is the primary objective?

Isolate affected systems

Remove the attacker's tools and access methods

Restore data from backups

Notify affected users

19. Which detection method uses predefined signatures to identify known threats?

Anomaly detection

Signature-based detection

Behavioral analysis

Heuristic detection

20. What is the primary goal of the containment phase in incident response?

Restore systems to normal operation

Stop the attack and prevent further damage

Identify how the attacker gained access

Document lessons learned

Incident Response Quiz: Do You Know All 6 Steps?

1. True or False: An incident response plan should be tested only after a real incident occurs.

2.

What first name or nickname would you like us to use?

2. A security incident must be reported to leadership within ____ hours to enable timely response.

3. Which phase involves restoring systems to their normal operational state?

4. True or False: The incident response process is linear and does not involve iteration.

5. Post-incident activities should include documentation of the incident timeline and ____.

6. Which containment strategy involves creating a copy of a system for analysis without affecting production?

7. True or False: During eradication, it is acceptable to simply restart compromised systems without removing malware.

8. Which of the following is a key component of incident response preparation?

9. The detection phase relies on monitoring tools to identify ____.

10. Which communication channel is typically used to notify stakeholders during an active incident?

11. Which phase of incident response focuses on establishing tools, policies, and training before an incident occurs?

12. Long-term containment strategies include ____.

13. What is the primary purpose of evidence preservation during incident response?

14. Which post-incident activity involves reviewing what happened and how to improve?

15. True or False: The recovery phase includes removing malware and patching vulnerabilities.

16. Short-term containment typically involves ____.

17. Which role is responsible for making critical decisions during an incident response?

18. In the eradication phase, what is the primary objective?

19. Which detection method uses predefined signatures to identify known threats?

20. What is the primary goal of the containment phase in incident response?