I85PREP
⌘ K
CCFR study materials
CCFR study resources

CCFR: Incident Response: Lifecycle, Containment, and Evidence Under Pressure

CCFR · Work through your exam, one topic at a time.

All guide sections

Incident Response: Lifecycle, Containment, and Evidence Under Pressure

Incident Response tests whether you can run the NIST lifecycle under pressure: detect, triage, contain, eradicate, recover, and learn without destroying evidence or business operations. The exam stresses decision order and documentation, not tool trivia.

Core rules

  • Lifecycle. NIST SP 800-61 organizes IR into Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity. PICERL is a common variant: Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned.
  • Triage. Confirm the event, classify it, assign severity from business impact and scope, and open a ticket with a timeline. Distinguish event, alert, and incident.
  • Containment. Choose isolation, network ACL, account disable, or segmentation based on spread risk and evidence value. Short-term containment stops the bleed; long-term containment supports recovery.
  • Evidence. Preserve volatile data before reimaging: RAM, running processes, network connections, and logs. Keep a decision log with UTC timestamps.
  • Communication. Use out-of-band channels if email is suspect; notify legal, privacy, and executive owners per policy.

Worked example

EDR flags a file server encrypting documents and a C2 beacon. You isolate the host at the switch, disable the compromised service account, and block the C2 IP. Before rebuilding, you capture RAM and the $MFT, export EDR and Windows event logs, and photograph the console. You then identify initial access (phishing), reset credentials, remove persistence, patch, and restore from an offline backup verified clean. Reasoning: isolation limits spread; memory capture preserves keys and process evidence; blocking the IP buys time but can be bypassed, so it is not the only control; restoring before eradication would reintroduce the intruder.

Traps

Reimaging before memory capture; deleting the malware before hashing it; shutting down a host and losing RAM; containing so aggressively that you lose scope; using the compromised mail system; closing the incident before verifying no persistence; and skipping lessons learned that would fix the root cause.