Explain appropriate incident response activities
The IR lifecycle in order, training, testing, root cause analysis, threat hunting, and digital forensics.
- Reading time
- 24 min read
- Flashcards
- 21 cards
- Practice questions
- 11 questions · 4 PBQs
Incident response is one of the most reliably scored objectives on the exam, because the lifecycle has a fixed order and CompTIA tests it directly. Learn the seven phases in sequence and a large share of the questions become recall.
The lifecycle
Preparation → Detection → Analysis → Containment → Eradication → Recovery → Lessons learned
Preparation
Everything done before an incident: the plan, the team, tooling, training, communication trees, and retainer agreements. The only phase that happens on a good day.
Detection
Recognising that something has happened — a SIEM alert, a user report, a threat feed match.
Analysis
Determining what actually happened, scope, and severity. Is it real? What is affected? How bad?
Containment
Stopping the spread. Isolate the host, block the address, disable the account. Buys time; does not fix anything.
Eradication
Removing the threat itself — deleting malware, closing the exploited vulnerability, removing attacker persistence and accounts.
Recovery
Restoring systems to normal operation and confirming they are clean, usually with heightened monitoring.
Lessons learned
The post-incident review: what worked, what did not, what changes. Feeds back into preparation.
Check yourself
Ransomware is spreading across file shares. What is the FIRST response action?
Containment has two flavours
Short-term containment is immediate and possibly crude: pull the network cable, block the IP, disable the account. Stops the bleeding.
Long-term containment is a sustainable stopgap while you prepare eradication — a temporary firewall rule, a rebuilt host on an isolated segment.
There is a real tension the exam sometimes probes: isolating a machine may destroy volatile evidence in memory. If a scenario emphasises preserving evidence for prosecution, capturing memory before pulling the plug matters.
Order of volatility
When collecting evidence, gather from most volatile to least, because the most volatile disappears first:
- CPU registers and cache
- RAM (running processes, network connections, encryption keys)
- Network state / temporary files
- Disk
- Remote logs and archives
- Physical media and printouts
Forensic concepts
Chain of custody
The documented record of who handled evidence, when, and why — unbroken from collection to court. A gap makes evidence inadmissible.
Legal hold
A formal instruction to preserve all data relevant to anticipated litigation. It overrides normal retention and deletion schedules.
E-discovery
The process of identifying and producing electronic evidence for legal proceedings.
Acquisition
Collecting the evidence, typically as a bit-for-bit forensic image rather than a file copy, so deleted and slack space are captured too.
Preservation
Protecting evidence from alteration — write blockers, hashing the image so any later change is detectable.
Reporting
Documenting findings so someone else could reach the same conclusions from the same evidence.
Check yourself
An analyst images a suspect drive, then hashes both the original and the image and records that they match. Why?
Testing the plan
A plan never tested is a plan that fails during the incident. Three exercise types, increasing in realism and disruption:
Tabletop
- Discussion-based, around a table
- Talk through a scenario
- No systems touched, lowest cost
Simulation
- A realistic scenario is played out
- e.g. a simulated phishing campaign
- Tests actual response behaviour
Failover / full test
- Actually switch to backup systems
- Highest confidence, highest disruption
The tellTabletop = talking. Simulation = doing, in a controlled way. Failover = really switching over.
Root cause analysis and threat hunting
Root cause analysis asks why the incident was possible, not just what happened. Removing the malware without finding how it arrived guarantees a repeat.
Threat hunting is proactively searching for compromise that no alert has flagged — assuming you are already breached and looking for evidence. It is the opposite posture to waiting for detection, and it is what catches the false negatives from 4.3.