LO4.1

Question 1

What is the typical five step order to responding to an incident?

Answer 1

Inform those involved
Assess extent of the incident
Contain the incident
Eradicate the incident
Reduce the impact and recover from the incident

Question 2

What are three examples of who you may inform when responding to an incident?

Answer 2

Customers
Stakeholders
Workers

Question 3

What is the benefit to assessing the extent of the incident?

Answer 3

It sets a start point to go from so people know what they’re doing when responding to the incident

Question 4

What are two examples to how you would contain the incident?

Answer 4

Isolating certain sensitive systems or data
Implementing security measures to mitigate additional damage

Question 5

What are three examples to how you could eradicate the incident?

Answer 5

Delete malware
Disable breached user accounts
Identify all affected hosts

Question 6

What are three examples of how you could reduce the impact and recover from the incident?

Answer 6

Rebuild systems from scratch
Install patches
Change passwords