Quiz: Incident Response
A 26-question self-check on the incident-response lifecycle, preparation, triage, containment, and the blameless postmortem. Questions tagged [Sec+] (CompTIA Security+) and [CISSP] ((ISC)² CISSP) map to those exam domains — incident response is heavily tested on both. Answers and one-line explanations are at the end; complete the whole quiz before checking.
Section 1 — Multiple choice (1 pt each)
1. [Sec+] Which is the correct order of the NIST SP 800-61 incident-response lifecycle? A. Detect → Prepare → Recover → Contain B. Prepare → Detect & Analyze → Contain, Eradicate, Recover → Post-Incident Activity C. Contain → Eradicate → Detect → Prepare D. Prepare → Recover → Detect → Eradicate
2. A security event differs from a security incident in that an incident: A. always involves malware B. is any observable occurrence C. violates or imminently threatens security policy and harms (or credibly threatens) the CIA triad D. must be reported to regulators
3. [Sec+] A scenario-specific response procedure written at the decision/coordination level (e.g., for ransomware) is a: A. runbook B. playbook C. policy D. baseline
4. The step-by-step technical procedure for one task (e.g., "isolate a Windows host in the EDR console"), executable by a tier-1 analyst under stress, is a: A. playbook B. runbook C. charter D. standard
5. [CISSP] The single person with authority to make and own decisions and coordinate during an incident is the: A. CISO B. SOC manager C. incident commander D. forensic lead
6. During an active ransomware encryption incident, the dominant containment concern is: A. avoiding tipping off the attacker B. preserving memory evidence above all C. stopping the (irreversible) damage immediately D. maintaining full business operations
7. [Sec+] For a deeply compromised host, the preferred eradication approach is: A. run antivirus and keep using it B. disconnect and monitor C. wipe and reimage from known-good media D. change the local admin password
8. Short-term containment is best described as: A. the permanent fix B. a fast, reversible action to stop immediate spread (e.g., isolate a host) C. rebuilding from backups D. the postmortem
9. [CISSP] The primary purpose of a blameless postmortem is to: A. identify who to discipline B. satisfy the auditor C. find systemic causes and produce durable improvements without assigning individual blame D. decide whether to pay the ransom
10. During recovery, restoring from backups only works if the backups are: A. encrypted with the production key B. stored on the same file server C. offline/immutable and tested for restoration D. taken yearly
11. [Sec+] A tabletop exercise is: A. a live attack on production systems B. a discussion-based simulation that walks a scenario without touching production C. a penetration test D. a backup restoration drill
12. "How far has it spread?" is the triage question most associated with: A. notification B. scoping C. eradication D. recovery
13. The biggest risk of loud, premature containment against a stealthy, long-resident intruder is: A. it preserves too much evidence B. it tips off the attacker, who burns known footholds and activates hidden ones C. it satisfies the regulator too early D. it is always reversible
14. [CISSP] Which best captures why "do we pay the ransom?" should be decided by policy in advance, not improvised in the war room? A. It is a simple financial calculation B. Responders are too junior C. It is a strategic/legal/ethical (and possibly sanctions) decision that payment cannot guarantee D. Regulators forbid all discussion of it
Section 2 — True / False with justification (1 pt each)
For each, mark T or F and give a one-sentence reason.
15. "Because the NIST lifecycle is a sequence, you must fully finish detection before any containment."
16. [Sec+] "A SOC should treat every security event as an incident to be safe."
17. "Keeping the only copy of the IR plan on the corporate file share is acceptable because it is backed up."
18. "Eradication is only as effective as the scoping that preceded it."
19. "A postmortem that produces a detailed report but no owned, deadlined action items has done its job."
Section 3 — Fill in the blank (1 pt each)
20. The two halves of containment are _ -term (fast, reversible) and _ -term (durable holding pattern).
21. [Sec+] Mapping an incident to a level on a SEV-1–SEV-4 matrix is called _ classification, and it drives escalation, resourcing, and _.
22. A _ is a scenario-level decision procedure; a _ is a step-by-step technical task procedure.
Section 4 — Short answer (2 pts each)
23. [CISSP] Explain why incident response is itself a security control, using two organizations that suffer the identical intrusion but reach opposite outcomes.
24. Name the four competing concerns in a containment decision, and explain how the incident type determines which concern dominates (contrast ransomware with a stealthy APT).
25. Describe the role of the communications plan for a regulated bank during a SEV-1, naming at least two external parties and why the "clock" is a challenge for responders.
Section 5 — Applied scenario (5 pts)
26. [Sec+] Saturday morning, Meridian's EDR alerts that a process is deleting volume shadow copies on three servers; overnight backups failed; scoping shows all three were reached from one domain-admin service account. (a) Assign a severity and justify it. (b) State your containment posture and the single dominant concern, with two specific containment actions. (c) Identify the eradication step the domain-admin compromise forces, and the recovery prerequisite that the shadow-copy deletion threatened. (d) Name one action item a blameless postmortem should produce.