CNCDP: Incident Response and Handling

Incident Response and Handling

This domain tests the lifecycle and the judgment calls inside it: what to do first, what not to destroy, who to notify, and how to prove the incident is closed. Expect scenario items where a plausible-sounding action (pulling the power cord) is the wrong answer.

The lifecycle (NIST SP 800-61)

1. Preparation: IR policy and plan, severity matrix, playbooks per scenario, contact and escalation trees, communications plan, out-of-band channels, forensic jump kit, retainer with external counsel/forensics, tabletop exercises, and pre-authorized containment actions.
2. Detection and analysis: validate the alert, determine scope (accounts, hosts, data, time window), assign severity, open the case record, begin the timeline, and start evidence preservation immediately.
3. Containment, eradication, recovery: short-term containment (isolate host at the network layer via EDR containment, disable accounts, block C2 at egress, rotate credentials) then long-term containment (rebuild, reimage, segmentation changes), eradicate persistence and initial access vector, restore from verified-clean backups in stages, and monitor closely after recovery.
4. Post-incident activity: lessons learned within days, root-cause and control-gap findings, playbook and detection updates, evidence retention per policy and legal hold, and metrics such as dwell time and time to contain.

Rules that decide marks

• Preserve before you rebuild: memory and disk artifacts vanish with a reimage, and pulling power destroys volatile state and encryption keys.
• Scope before you eradicate. Removing the first host you find leaves the persistence mechanism intact.
• Notification has legal clocks: GDPR Article 33 requires notifying the supervisory authority within 72 hours of awareness where personal data is breached; HIPAA breach notification to affected individuals generally within 60 days; sector regulators and card brands have their own timetables. Legal counsel participates in notification decisions.
• Document contemporaneously - timestamps, decisions, who authorized what. The case record is also evidence.

Worked example

EDR flags vssadmin deleting shadow copies on a file server, followed by mass file renames to a new extension. Sequence: confirm and scope (all hosts showing the binary, all accounts used), contain by network-isolating affected hosts through EDR and disabling the compromised service account, block the identified C2 domain at egress, capture memory and disk images before remediation, check backups are offline and uninfected, eradicate persistence and reset credentials (twice for krbtgt if domain admin compromise is confirmed), restore in priority order, then run lessons learned and update the playbook.

Traps that cost marks

• Powering off or reformatting a host during containment.
• Eradicating before scoping, leaving the access path live.
• Skipping evidence handling because "we just need it fixed".
• Assuming backups are clean without verification, and restoring over live data.