Incident Response and Defense in Depth
This domain tests the response lifecycle and the layering principle that keeps a single control failure from becoming a breach. Expect questions on phase ordering, evidence handling, containment choices, and which layer closes a gap.
Core rules
- NIST SP 800-61 lifecycle: Preparation; Detection and Analysis; Containment, Eradication and Recovery; Post-Incident Activity. Containment precedes eradication - wiping a host before scoping the intrusion destroys your ability to find the other infected hosts.
- Order of volatility: CPU and memory before disk, disk before remote logs and backups. Powering off loses memory-resident evidence; isolate the network instead.
- Chain of custody: document who handled evidence, when, and why; image with a write blocker; hash before and after (SHA-256) and record both.
- Containment is a trade-off between stopping spread and preserving business function: host isolation, account disable, VLAN quarantine, egress block, or segment shutdown.
- Recovery must be validated, not assumed: known-good backups, rebuild rather than clean when rootkit or persistence is suspected, and watch restored hosts closely.
- Defense in depth means independent, overlapping controls at identity, perimeter, network, endpoint, application, data, and human layers, so bypassing one does not yield the objective.
Worked example
Ransomware is encrypting a file server. Walk the first hour.
Reasoning: contain first, minimally and reversibly - disable the compromised service account, isolate the file server from the network (not power-off, to preserve memory and key material), and block SMB laterally between workstation VLANs. Preserve evidence before remediation: memory capture, disk image, and export of the EDR process tree. Then scope: which hosts wrote ransom notes, which accounts authenticated to the server in the previous 24 hours, and where the encryptor's parent process came from. Eradicate by rebuilding affected hosts from a known-good image; restore from an offline, immutable backup taken before the encryption window and verify integrity. The depth fix afterwards is not better antivirus but egress filtering plus application allowlisting plus removal of standing admin rights - three independent layers, each of which would have broken the chain.
Traps
- Powering off or reimaging before imaging - the most common forensic mistake.
- Blocking a single C2 IP; attackers rotate infrastructure, so block the behaviour instead.
- Declaring recovery complete without verifying backup integrity or re-infection.
- Skipping lessons learned and the control-gap remediation that justifies the final phase.
- Missing legal, regulatory, and communications obligations that run in parallel with the technical response.