IR Lifecycle Quiz: Do You Know Every Phase?

1. What role does chain of custody play in the incident response lifecycle?

It ensures forensic evidence integrity and admissibility in legal proceedings

It speeds up system recovery

It eliminates the need for backups

It prevents employee termination

Submit

6. What is a critical metric tracked during the analysis phase to measure incident severity?

Time to detect and mean time to respond

Number of emails sent

Office temperature

Employee attendance records

7. Which communication channel is typically used during the detection phase to report a suspected incident?

Social media

Incident response team or security operations center (SOC)

Personal email

Company newsletter

8. In preparation, what is the importance of an incident response plan?

It provides a documented framework to guide response actions during incidents

It guarantees incidents will never occur

It eliminates the need for trained personnel

It replaces cybersecurity controls

9. What is the primary objective of the recovery phase?

Identify how the attacker entered the network

Restore systems to a known-good state and verify normal operations

Terminate all user accounts

Conduct a forensic autopsy

10. During eradication, what must be done to ensure the threat does not persist?

Reboot systems once and resume operations

Remove root causes, patch vulnerabilities, and verify with independent validation

Simply delete suspicious user accounts

Disconnect the network permanently

11. Which phase of the incident response lifecycle focuses on establishing tools, procedures, and training before an incident occurs?

Preparation

Detection

Analysis

Recovery

12. Which of the following is a key deliverable during the post-incident activity phase?

Incident report and lessons learned document

List of all employees to terminate

Backup of corrupted data

Marketing campaign announcement

13. In containment, what is the difference between short-term and long-term containment?

Short-term is temporary; long-term is permanent remediation

Both are identical strategies

Short-term removes malware; long-term prevents future incidents

Long-term is faster than short-term

14. What does triage involve during the detection and analysis phase?

Prioritizing incidents by severity and potential impact

Deleting suspicious files immediately

Notifying all employees of every alert

Closing all network connections

15. During preparation, which tool is essential for detecting potential security incidents?

SIEM (Security Information and Event Management)

Word processor

Email client

Web browser

16. What is the primary focus of post-incident activity in the IR lifecycle?

Immediately deploy patches to all systems

Review lessons learned and improve processes for future incidents

Delete all forensic evidence

Terminate the IR team

17. Which incident response phase involves restoring systems to normal operations and verifying functionality?

Containment

Eradication

Recovery

Post-Incident Activity

18. In the eradication phase, the IR team removes malware and patches vulnerabilities. What critical step follows eradication?

Immediately declare the incident resolved

Verify that the threat has been completely removed

Archive all forensic evidence

Begin the recovery phase without validation

19. What is the purpose of the containment phase in incident response?

Remove the threat and restore normal operations

Prevent the incident from spreading and limit damage

Investigate the root cause of the breach

Conduct a post-incident review

20. During the detection and analysis phase, what is the primary goal when identifying suspicious activity?

Immediately shut down all systems

Determine if an incident has occurred and assess its scope

Archive all logs without review

Notify the public immediately