Domain 5 of 5 · Chapter 3 of 5

Understand Incident Response

Unlock the complete study guide + 12 practice exams totaling 1,500 questions.

Bundled into the existing Certified in Cybersecurity premium course — no separate purchase.

14-day money-back guarantee — no questions asked.

Included in this chapter:

  • Incident response at a glance
  • The incident response plan: roles and authority
  • Layers of incident response documentation
  • Reporting a suspected incident
  • Keeping incident records
  • Handling potential evidence
  • Incident communications
  • The three response goals
  • Scoping an incident beyond the first system
  • Recovering without reintroducing the incident
  • Incident response alongside continuity and recovery plans
  • Learning from incidents
  • Three ways to check readiness
  • The exercise life cycle

Tabletop exercise vs functional exercise vs test

AspectTabletop exerciseFunctional exerciseTest
What participants doDiscuss their roles, coordination and decisions for a scenarioPerform their duties as they would in a real incident, but in a simulated mannerRun a system or component and measure the result
SettingClassroom or breakout groups led by a facilitator; no equipment or other resources deployedSimulated operational environmentAs close to the operational environment as possible
Typical question it answersWho approves the customer notification?Can the team send notifications and hand off work under simulated conditions?Does the alert actually reach the on-call responders within the required time?
Evidence it producesObservations from the discussionObserved actions compared with the exercise objectivesQuantifiable metrics compared with the test plan
Main limitDoes not show that systems or equipment actually workRuns in a simulation, not the operational environmentCovers only the systems or components in the test plan

Decision tree

Have personnel beentrained on their roles?Training firstbefore any exercise or testIs the doubt whether a systemor component really works?Testquantifiable metricsMust participants performactions, not only discuss?Functional exercisesimulated environmentTabletop exercisediscussion-based onlyNoYesYesNoYesNoEach exercise or test: objectives set in design, after-action report from evaluation
Cheat sheet

Cheat sheet

  • An incident response plan designates who is responsible for the response
  • An entry-level practitioner reports suspected incidents through the established process
  • Playbooks provide procedures for particular incident situations
  • Incident communications follow the plan and applicable reporting obligations
  • Responders may need a communication channel outside the compromised environment
  • Incident response may activate continuity and disaster recovery plans
  • Incident records can contain sensitive data and need controlled access
  • Chain of custody records who handled evidence and why it moved
  • Responders record both findings and actions taken
  • Uncoordinated cleanup can destroy evidence needed by responders
  • Incident evidence is retained according to preservation and retention requirements
  • Containment limits the spread and impact of an incident
  • Eradication removes the components and conditions sustaining a compromise
  • Recovery restores affected services and verifies that they can operate safely
  • Recovery sources must be checked before they are used
  • Responders must determine whether a compromise extends beyond the first affected system
  • Lessons from incidents should lead to improvements in controls and response procedures
  • A tabletop exercise evaluates response decisions through discussion
  • A functional exercise has participants carry out roles in a simulated operational setting
  • A test checks whether a response component actually works
  • Exercise objectives define what readiness evidence the exercise should produce
  • New information during an exercise tests how participants adapt their response
  • Exercise findings should produce corrective actions and updated plans

Unlock with Premium — includes all practice exams and the complete study guide.

Also tested in

References

  1. https://www.isc2.org/certifications/cc/cc-certification-exam-outline
  2. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r3.pdf
  3. https://csrc.nist.gov/pubs/sp/800/61/r3/final
  4. https://csrc.nist.gov/glossary/term/incident_response_plan
  5. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf
  6. https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-86.pdf
  7. https://csrc.nist.gov/glossary/term/chain_of_custody
  8. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-184.pdf
  9. https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-84.pdf
  10. https://csrc.nist.gov/glossary/term/test
  11. https://csrc.nist.gov/glossary/term/tabletop_exercise
  12. https://csrc.nist.gov/glossary/term/functional_exercise