Incident response process steps and security operations monitoring concepts tested on the Security+ exam.
39 cards · basic cards · AI-written, checked twice. Edit anything.
- Define incident response.
Show answer
A structured set of procedures and capabilities to detect, contain, eradicate, and recover from security events with minimal damage.- What happens during the Preparation phase of incident response?
Show answer
Tools, training, and documentation are put in place before an incident occurs, including playbooks, monitoring systems, and team readiness.- What is the goal of the Detection phase in incident response?
Show answer
Identify and recognize that a security incident has occurred using monitoring tools and alerts.- What occurs during the Analysis phase of incident response?
Show answer
Determine the nature, scope, timeline, and impact of the incident through investigation and evidence collection.- Define containment in incident response.
Show answer
Actions taken to stop the spread and impact of a security incident, typically divided into short-term containment and long-term containment.- What is the difference between short-term and long-term containment?
Show answer
Short-term containment stops immediate spread with temporary fixes, while long-term containment removes the threat permanently to prevent recurrence.- What is eradication in incident response?
Show answer
The process of removing the attacker, malware, and artifacts from the environment to eliminate the root cause of the incident.- What does the Recovery phase accomplish?
Show answer
Restore systems and data to normal operations, verify functionality, and rebuild confidence that the threat is completely removed.- What is the purpose of the Post-Incident Activity phase?
Show answer
Conduct a lessons learned meeting, update playbooks, improve processes, and document findings to prevent similar incidents.- Define chain of custody.
Show answer
A documented record of who collected, handled, and transferred evidence, maintaining its integrity and admissibility in legal proceedings.- What is the primary goal of forensic evidence preservation?
Show answer
Maintain the integrity and authenticity of evidence so it remains admissible in court and accurately reflects what was found.- What does SIEM stand for?
Show answer
Security Information and Event Management - a platform that collects, aggregates, and analyzes security event logs from multiple sources.- What is log aggregation?
Show answer
The process of collecting logs from multiple systems and devices into a central repository for analysis and correlation.- What does SOAR stand for and what does it do?
Show answer
Security Orchestration, Automation and Response - a platform that automates security response processes and orchestrates tools to reduce manual work.- Define threat hunting.
Show answer
A proactive process of searching for indicators of compromise and advanced threats that automated systems may have missed.
FlashKeepers