Chapter 14

Question 1

Preparation Phase

Answer 1

Build the tools, processes, and procedures to respond to an incident.

Question 2

Identification Phase

Answer 2

Reviewing events to identify incidents.

Question 3

Containment Phase

Answer 3

Once an incident has been identified, the response team needs to contain it to prevent further issues or damage.

Question 4

Eradication Phase

Answer 4

Removing the artifacts associated with the incident.

Question 5

Recovery Phase

Answer 5

Restoration to normal is the heart of the recovery phase.

Question 6

Lessons Learned Phase

Answer 6

Restating and discussing how improvements can be made to tools, processes, and procedures.

Question 7

Tabletop Exercises

Answer 7

Team members are given a scenario and are asked question about how they would respond, what issues might arise, and what they would need to do to accomplish the tasks assigned to them.

Question 8

Walk-throughs

Answer 8

Taking a team through an incident step by step.

Question 9

Simulations

Answer 9

Simulations of individual or entire events involving all relevant parties.