Incident Response

Question 1

Step 1

Answer 1

Detection: An alert indicates unusual outbound traffic.

Question 2

Step 2

Answer 2

Containment: Disconnect affected machines and block suspicious domains.

Question 3

Step 3

Answer 3

Eradication: Identify malware, remove it, and patch the vulnerability.

Question 4

Step 4

Answer 4

Recovery: Restore systems from backups and monitor for lingering threats.

Question 5

Step 5

Answer 5

Post-Incident Review: Analyze the incident, update policies, and train employees.