Incident Response and Management

An endpoint detection and response (EDR) alert shows WINWORD.EXE starting powershell.exe, and a minute later the host contacts a domain nobody recognizes. Three questions follow at once: What is the attacker doing? What is this response step for? How is the step carried out? This domain, 24% of the exam, is built on those three questions: the first is about the attacker's steps, and the other two are about the defender's work on an incident (by the standard definition, an occurrence that actually or imminently jeopardizes, without lawful authority, the confidentiality, integrity, or availability of information or an information system, or constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies). Keep the two sides apart, because the Cyber Kill Chain (a model of an intrusion as ordered phases) and this guide's incident response phases both number seven, so a phase name in a scenario only makes sense once you know whose actions it describes.

First, Interpret attack methodology frameworks answers What is the attacker doing?: the Cyber Kill Chain places evidence in seven ordered phases to show how far an intrusion got, MITRE ATT&CK (a knowledge base of adversary behavior) separates the adversary's goal (a tactic, one unordered column of its matrix) from the method (a technique), and the Diamond Model of Intrusion Analysis relates events through four core features (adversary, capability, infrastructure, victim). Second, Explain the incident response process answers What is this response step for?: this guide's seven incident response phases (Preparation, Detection, Analysis, Containment, Eradication, Recovery, Post-incident) offer a finer study breakdown of the four phases of NIST SP 800-61 Rev. 2 (the National Institute of Standards and Technology's incident handling guide); its successor, Rev. 3, organizes the same activities around the NIST Cybersecurity Framework (CSF) 2.0 Functions and integrates improvement throughout, so this guide's incident response phases neither rival Rev. 3 nor map one-to-one onto it. Third, Implement incident response techniques answers How is the step carried out?, from plans and playbooks through logs, triage, evidence handling, isolation, and restoration to root cause analysis. Every technique serves one or more incident response phases, so the process page comes first.

When two answers both look reasonable, prefer the one that checks a label against evidence, because the same shortcut fails on every page of this domain. One matched ATT&CK technique is an investigative lead, not attribution to a threat group; a malware family name in an alert is input to Analysis, not a declared incident; an old reputation label on an address is a reason to look, not proof of current malicious use. Later in the response, a quiet period after quarantine does not show that remediation worked, and naming the ransomware family is not a root cause. In each case the stronger answer gathers what the label skipped: more context, a search of other plausible targets, a verified fix, or the underlying weakness that let the incident happen.