Incident Response Procedures
CompTIA Security+ SY0-701 (V7) PBQ
Match incident response phases with appropriate actions and procedures. This helps students understand what steps should be taken during each phase of the incident response lifecycle according to best practices.
Some options will have multiple correct answers.
Disable compromised user accounts and credentials
Establish and train response team roles and responsibilities
Validate and categorize security incidents
Develop incident response plan
Conduct post-incident review and root cause analysis
Analyze logs and alerts to detect anomalies
Remove malware and malicious artifacts
Restore systems and data from clean backups
Isolate affected systems to prevent spread
Update incident response plan and security controls
Apply short-term fixes or network segmentation
Monitor systems and validate normal operations
Eradication
Identification
Preparation
Recovery
Lessons Learned
Containment