Incident Response and Handling
Incident Response and Handling
This domain tests the full incident lifecycle and the judgement calls inside it: when to contain, what to preserve, who to notify and how you prove the incident is closed. Questions frequently present a scenario and ask for the next correct action rather than a definition.
Lifecycle
NIST SP 800-61 frames the lifecycle as Preparation; Detection and Analysis; Containment, Eradication and Recovery; Post-Incident Activity. Many operations teams use the PICERL variant with separate Containment, Eradication and Recovery steps. Preparation covers playbooks, tooling, contact lists, out-of-band communications, log retention and pre-authorised containment. Detection and analysis covers triage, validation, scoping, severity assignment and evidence-preserving data collection.
Containment decisions
- Short-term containment buys time: network isolation via EDR, ACL or switch port shutdown, credential reset, blocking infrastructure.
- Long-term containment supports continued business operation while rebuilds happen, for example a clean VLAN or a rebuilt host.
- Preserve before you destroy. Pulling power destroys memory-resident evidence such as injected code, keys and volatile network state. Prefer logical isolation that keeps the host running while acquisition proceeds.
- Scope before you eradicate: find all affected hosts, accounts and persistence, or the actor simply returns.
Eradication, recovery, lessons learned
Eradication removes the root cause, not just the symptom: malware, persistence, vulnerable entry point, compromised credentials. Recovery requires validation evidence such as clean scans, monitored uptime and confirmed patch level before closing. Post-incident activity should produce a timeline, root cause, control gaps and owned corrective actions with dates; a lessons-learned report filed and never actioned is a finding in itself.
Worked example: a file server shows mass file renaming with a ransomware extension and a readable note. You isolate the host logically rather than shutting it down, capture memory, preserve event logs and the note, then identify the account and process behind the encryption. You disable the account, force a domain-wide reset for privileged accounts, inspect backups for integrity, and check file-share and RDP logs for lateral movement before rebuilding from a verified clean backup. Regulatory and internal notification timelines are checked the same day.
Traps: powering off a live host before memory capture; wiping and rebuilding before imaging; containing a single host without scoping; declaring recovery on the basis of a clean antivirus scan only; missing notification obligations or the evidence log entry for each action taken.