8.2. The Incident Response Lifecycle

Try these first

1. 1.

   What does SIEM stand for?

   Hint

   Think about what tools you would use to manage security incidents.

2. 2.

   Name one task done in the Preparation phase.

   Hint

   What document outlines how to respond to incidents?

3. 3.

   What is the first phase of the Incident Response Lifecycle?

   • Identification
   • Preparation
   • Containment

   Hint

   Think about which phase sets the groundwork for everything else.

4. 4.

   True or False: The Eradication phase involves bringing systems back online.

   • True
   • False

   Hint

   What comes first: cleaning or bringing systems online?

5. 5.

   You are part of an Incident Response Team responding to a ransomware attack. Describe the steps you would take through each phase of the Incident Response Lifecycle.

   Hint

   Use your understanding of each phase to create a logical response.

6. 6.

   A company did not document lessons learned from a past incident and faced a similar incident later with severe consequences. Discuss the potential impacts of this oversight.

   Hint

   Think about how learning from experience helps organizations grow.