CompTIA Security+ Preparation · lesson 29 of 45 · 25 min
What Is Incident Response?
A security incident is any event that threatens the confidentiality, integrity, or availability of information or systems. Incident response (IR) is the organized approach to managing and recovering from security incidents. A well-practiced IR process minimizes damage, reduces recovery time, and preserves evidence.
The Security+ exam tests the NIST SP 800-61 incident response lifecycle and key concepts like containment strategies, evidence handling, and lessons learned.
NIST IR Lifecycle (SP 800-61)
Memory tip
PDREP-L: Preparation → Detection → Containment → Eradication → Recovery → Lessons Learned. Or remember: “Please Don’t Call Every Response Late.”
Containment Strategies
Incident Severity Classification
Flashcard Drill
NIST SP 800-61 NIST’s Computer Security Incident Handling Guide — defines the 6-phase IR lifecycle. Preparation phase Building IR capability before incidents — IR plan, playbooks, trained team, tools. Containment Stopping the spread of an incident — isolation, segmentation, or removal of affected systems. Eradication Removing the root cause — malware removal, account cleanup, patching. Lessons learned Post-incident review to improve the IR process — what worked, what failed, what to change. IOC Indicator of Compromise — evidence of a breach (malicious IP, hash, domain, registry key). Playbook Step-by-step IR procedure for a specific incident type (ransomware, phishing, data breach). Chain of custody Documentation of who handled evidence, when, and how — required for legal proceedings. CSIRT Computer Security Incident Response Team — the team responsible for handling incidents. Tabletop exercise Discussion-based IR simulation — team walks through a scenario without actually executing response actions.
Scenario Practice
Ransomware Response
Wait until morning to assess the full scope. Immediately isolate affected servers from the network to stop the spread, then escalate to the IR team. Pay the ransom immediately to restore files. Reimage all servers immediately without preserving evidence. 1 Containment is the immediate priority — isolate affected systems to stop lateral spread. Then escalate to the IR team for eradication and recovery. Reimaging without evidence preservation destroys forensic data. Paying ransom is a last resort and does not guarantee recovery.
Knowledge Check
Incident Response — 10 Questions
Which phase of the NIST IR lifecycle involves removing malware and patching the exploited vulnerability?
- Containment
- Eradication
- Recovery
- Detection
Answer: Eradication
Eradication removes the root cause — malware, backdoors, and the vulnerability that was exploited.
What is the primary goal of the Containment phase?
- Remove malware
- Restore systems
- Stop the spread and limit damage
- Document lessons learned
Answer: Stop the spread and limit damage
Containment stops the incident from spreading further — isolation, segmentation, or removal.
The Lessons Learned phase should be skipped if the incident was minor to save time.
- True
- False
Answer: False
Every incident — even minor ones — provides learning opportunities. Skipping lessons learned means repeating the same mistakes.
Evidence of a breach such as a malicious IP address, file hash, or registry key is called an Indicator of _____.
Answer: Compromise
IOCs (Indicators of Compromise) are artifacts that indicate a system has been breached.
Which containment strategy preserves attacker activity for intelligence gathering while limiting spread?
- Isolation
- Removal
- Monitoring
- Segmentation
Answer: Monitoring
Monitoring the attacker without alerting them allows intelligence gathering — useful for tracking APT movement and understanding TTPs.
A step-by-step IR procedure for a specific incident type (e.g. ransomware) is called a:
- Policy
- Playbook
- Standard
- Guideline
- Answer: Playbook
IR playbooks provide specific, actionable steps for handling known incident types.
Which activities belong to the Preparation phase? (Select all that apply)
- Writing IR playbooks
- Isolating infected systems
- Training the IR team
- Removing malware
- Establishing communication plans
Answer: Writing IR playbooks
Training the IR team
Establishing communication plans Preparation happens before incidents — playbooks, training, and communication plans. Isolation is Containment; malware removal is Eradication.
Which NIST document defines the computer security incident handling lifecycle?
- NIST CSF
- NIST SP 800-53
- NIST SP 800-61
- NIST SP 800-171
Answer: NIST SP 800-61
NIST SP 800-61 is the Computer Security Incident Handling Guide — it defines the 6-phase IR lifecycle.
A tabletop exercise involves actually executing IR procedures on live systems.
- True
- False
Answer: False
A tabletop exercise is discussion-based — the team talks through a scenario without executing actual response actions.
Chain of custody documentation is required to:
- Speed up incident response
- Ensure evidence is admissible in legal proceedings
- Automate malware removal
- Classify incident severity
- Answer: Ensure evidence is admissible in legal proceedings
Chain of custody documents who handled evidence, when, and how — required to maintain evidence integrity for legal use.
Previous lesson: Identity and access management: MFA, SSO, PAM, directory services
Back to CompTIA Security+ Preparation
Next lesson: Mobile device management: MDM, MAM, BYOD, containerization, remote wipe